CVE-2025-47933 – XSS Flaw in Argo CD

CVE-2025-47933 is a critical severity vulnerability discovered in Argo CD, a widely adopted declarative GitOps continuous delivery tool for Kubernetes. The vulnerability has been assigned a CVSS v3.1 base score of 9.0, indicating that it poses a significant threat to affected systems. It allows authenticated users with repository modification privileges to inject malicious JavaScript payloads that can execute within the browser of other users, potentially leading to unauthorized actions via the Argo CD API.

🛠 Technical Details

The vulnerability is rooted in improper validation and sanitization of user-controlled input—specifically, the repository URLs configured within the Argo CD web interface. The application fails to adequately filter or block URLs that use the javascript: scheme, thereby introducing a classic reflected/stored XSS attack vector.

An attacker with sufficient permissions (e.g., someone with access to modify repositories) could craft a malicious repository entry with a javascript: payload. Once another user views this entry—typically via the repository settings or deployment views—the injected JavaScript executes in the context of the victim’s browser session.

Since authenticated users’ sessions are tied to Argo CD’s web interface and APIs, the script can perform any action that the victim is authorized to do. This may include:

• Unauthorized modification or deletion of applications.
• Injection of new, potentially malicious Kubernetes manifests.
• Lateral movement across environments via GitOps automation.

🎯 Affected Versions

The vulnerability affects the following versions across multiple branches of the Argo CD project:

• Argo CD v1.x:
  Versions from 1.2.0-rc1 through 1.8.7
• Argo CD v2.x:
  • From 2.0.0-rc3 up to, but not including, 2.13.8
  • From 2.14.0-rc1 up to, but not including, 2.14.13
• Argo CD v3.x:
  • All versions prior to 3.0.4

✅ Remediation

To fully mitigate this vulnerability, the Argo CD maintainers have issued patches across the impacted branches. Users are strongly advised to upgrade to one of the following secure versions:

• 2.13.8 (for v2.13.x)
• 2.14.13 (for v2.14.x)
• 3.0.4 (for v3.x series)

These versions contain the necessary fixes to sanitize URL inputs and prevent execution of untrusted JavaScript payloads.

🔐 Mitigation & Best Practices

In addition to applying the patch, organizations should implement the following security hygiene practices:

1. Restrict Repository Access:
   Limit repository modification privileges to a minimal set of trusted DevOps or SRE personnel.
2. Input Validation Policies:
   Validate all user-submitted inputs where possible. Disallow dangerous schemes such as javascript: entirely within your own CI/CD integrations.
3. Monitor Audit Logs:
   Regularly monitor Argo CD’s logs for any suspicious activity, particularly the creation or modification of repositories and application configurations.
4. Implement Content Security Policy (CSP):
   Although CSPs can be bypassed in some contexts, they offer an additional layer of protection against reflected and stored XSS attacks.
5. Session Management:
   Enable short session lifetimes and consider enforcing multi-factor authentication to reduce the risk of session hijacking.