PT-2025-23137 · Argo Cd · Argo Cd

Ry0Tak · CVE-2025-47933 · Published 2025-05-28 · Updated 2025-08-27

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4

Description This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. The vulnerability is caused by the improper filtering of URL protocols in the repository page, allowing an attacker to achieve cross-site scripting with permission to edit the repository. The ui/src/app/shared/components/urls.ts file contains code that parses the repository URL without validating the protocol, making it possible to inject javascript: URLs. This can lead to cross-site scripting as the return value of this function is used in the href attribute of the a tag.

Recommendations Update to Argo CD version v2.13.8 or later to fix the vulnerability. Update to Argo CD version v2.14.13 or later to fix the vulnerability. Update to Argo CD version v3.0.4 or later to fix the vulnerability. As a temporary workaround, consider relying on the browser to filter the URL until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06327

BIT-ARGO-CD-2025-47933

CVE-2025-47933

GHSA-2HJ5-G64G-FP6P

GO-2025-3720

OPENSUSE-SU-2025:15188-1

RHSA-2025:8269

Affected Products

Argo Cd

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47933.json · Exploit
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p · Patch
• https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-47933 · Security Note
• https://osv.dev/vulnerability/GO-2025-3720 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hj5-g64g-fp6p · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15188-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47933 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06327 · Security Note
• https://osv.dev/vulnerability/BIT-argo-cd-2025-47933 · Vendor Advisory
• https://github.com/argoproj/argo-cd · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/5W5NDYFJCKVTB2UYZO6OSRFA7RGWGHY3 · Note
• https://suse.com/security/cve/CVE-2025-4057 · Note
• https://twitter.com/iVarunVerma/status/1929931858051248309 · Twitter Post
• https://twitter.com/vulert_official/status/1928023095475921198 · Twitter Post