CVE-2025-47933

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-47933
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47933.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-47933
Aliases
Downstream
Related
Published
2025-05-29T19:30:39.108Z
Modified
2026-02-04T03:45:15.356466Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Argo CD allows cross-site scripting on repositories page
Details

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47933.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/argoproj/argo-cd

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
2c691a874b7acd708712396691ea2b050846229c
Last affected
eb3d1fb84b9b77cdffd70b14c4f949f1c64a9416
Database specific 
{
    "versions": [
        {
            "introduced": "1.2.0-rc1"
        },
        {
            "last_affected": "1.8.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
9a07ef02986b62b41d62168674f8ba49696b5a82
Fixed
612d345cd926d0b05d1755e3e0717b01ccd20740
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0-rc3"
        },
        {
            "fixed": "2.13.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
2ac03b515226b7bfb12665b6a7a4077d3ad55d60
Fixed
5ad281ef56a7ff11aab743ab004a470bf3ecf08c
Database specific 
{
    "versions": [
        {
            "introduced": "2.14.0-rc1"
        },
        {
            "fixed": "2.14.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
226a670fe6b3c6769ff6d18e6839298a58e4577d
Fixed
5328bd58e6255e31c858cc1b628552d32bd105e0
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0-rc1"
        },
        {
            "fixed": "3.0.4"
        }
    ]
}

Affected versions

v2.*
v2.14.0
v2.14.0-rc1
v2.14.0-rc2
v2.14.0-rc3
v2.14.0-rc4
v2.14.0-rc5
v2.14.0-rc6
v2.14.0-rc7
v2.14.1
v2.14.10
v2.14.11
v2.14.12
v2.14.2
v2.14.3
v2.14.4
v2.14.5
v2.14.6
v2.14.7
v2.14.8
v2.14.9
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.0.0-rc4
v3.0.0-rc5
v3.0.0-rc6
v3.0.1
v3.0.2
v3.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47933.json"