-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The ExternalLink constructor in application-urls.tsx originally didn't validate URL protocols, allowing injection of javascript: links. The patch added validation that throws errors for unsafe protocols. 2) The ApplicationSummary component directly processed user-controlled externalURLs annotations without proper sanitization, using split('|') to handle URL parts. The combination of these two factors allowed malicious links to be rendered. The commit fixes both by introducing protocol validation in ExternalLink and using the validated ExternalLinks function in ApplicationSummary.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd/v2 | go | >= 2.9.0, < 2.9.8 | 2.9.8 |
| github.com/argoproj/argo-cd/v2 | go | >= 2.10.0, < 2.10.3 | 2.10.3 |
| github.com/argoproj/argo-cd/v2 |
| go |
| >= 2.0.0, < 2.8.12 |
| 2.8.12 |
| github.com/argoproj/argo-cd | go | >= 1.0.0, <= 1.8.7 |
Ongoing coverage of React2Shell