Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Argo CD v2 (github.com/argoproj/argo-cd/v2) versions 2.11.0 through 2.14.21 and v3 (github.com/argoproj/argo-cd/v3) versions 3.0.0 through 3.3.14, 3.4.0 through 3.4.9, 3.5.0 through 3.5.3, and 3.6.0-rc1 are affected by command injection through a crafted proxy URL on SSH repositories. Users who can create or update repositories or repository credential templates can inject shell commands that run in the repo-server. Upgrade v3 to 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2 or later; no fixed version is listed for v2, which is out of support.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.8 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.019, the 79th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:11 UTC First seen by agentprime
- 31 Oct 2026, 14:11 UTC Confirmed by OSV