https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:11:20 +0000 https://vulnerability.circl.lu/vuln/ghsa-h98r-wv3h-fr38 <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd/v3, Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd</p> <p>### Summary</p> <p>A user with **application write access (developer role)** can set `link.argocd.argoproj.io/*` annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab&#39;s **URLs section** as `&lt;a href&gt;` elements without URL validation. Using the pipe-separator trick (`Display Text | javascript:...`), an attacker can inject a `javascript:` URI while displaying a legitimate-looking label (e.g. `GitHub Repo`). When a higher-privileged user (admin) clicks the link, **arbitrary JavaScript executes in the ArgoCD origin context** in the admin&#39;s authenticated session context, enabling API exfiltration and privilege escalation from developer to admin.</p> <p>### Details</p> <p>**Vulnerable sink:** `ui/src/app/applications/components/application-summary/application-summary.tsx:277`</p> <p>```tsx const parts = (url || &#39;&#39;).split(&#39;|&#39;); &lt;a key={i} href={parts.length &gt; 1 ? parts[1] : parts[0]} target=&#39;_blank&#39;&gt; {parts[0]} &lt;/a&gt; ```</p> <p>The annotation value is split on `|`. `parts[0]` becomes the visible link label; `parts[1]` becomes the `href`. **No call to `isValidURL()` is made**, unlike the protected `ApplicationURLs` component (`application-urls.tsx:72,80`) which does validate URLs and blocks `javascript:`. The `target=&#39;_blank&#39;` opens a new tab that inherits the ArgoCD origin, giving the injected script same-origin fetch access to all ArgoCD APIs using the victim&#39;s authenticated session (credentialed `fetch()` calls).</p> <p>**Root cause:** React 16.x does not block `javascript…</p> <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd/v3, Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd</p> <p>### Summary</p> <p>A user with **application write access (developer role)** can set `link.argocd.argoproj.io/*` annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab&#39;s **URLs section** as `&lt;a href&gt;` elements without URL validation. Using the pipe-separator trick (`Display Text | javascript:...`), an attacker can inject a `javascript:` URI while displaying a legitimate-looking label (e.g. `GitHub Repo`). When a higher-privileged user (admin) clicks the link, **arbitrary JavaScript executes in the ArgoCD origin context** in the admin&#39;s authenticated session context, enabling API exfiltration and privilege escalation from developer to admin.</p> <p>### Details</p> <p>**Vulnerable sink:** `ui/src/app/applications/components/application-summary/application-summary.tsx:277`</p> <p>```tsx const parts = (url || &#39;&#39;).split(&#39;|&#39;); &lt;a key={i} href={parts.length &gt; 1 ? parts[1] : parts[0]} target=&#39;_blank&#39;&gt; {parts[0]} &lt;/a&gt; ```</p> <p>The annotation value is split on `|`. `parts[0]` becomes the visible link label; `parts[1]` becomes the `href`. **No call to `isValidURL()` is made**, unlike the protected `ApplicationURLs` component (`application-urls.tsx:72,80`) which does validate URLs and blocks `javascript:`. The `target=&#39;_blank&#39;` opens a new tab that inherits the ArgoCD origin, giving the injected script same-origin fetch access to all ArgoCD APIs using the victim&#39;s authenticated session (credentialed `fetch()` calls).</p> <p>**Root cause:** React 16.x does not block `javascript…</p> https://vulnerability.circl.lu/vuln/ghsa-h98r-wv3h-fr38