Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Argoproj | Argo Cd | >= 1.2.1, < 2.13.8 |
Related Weaknesses (CWE)
References
- https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9ePatch
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6pPatchThird Party Advisory
FAQ
What is CVE-2025-47933?
CVE-2025-47933 is a vulnerability with a CVSS score of 9.0 (CRITICAL). Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. D...
How severe is CVE-2025-47933?
CVE-2025-47933 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-47933?
Check the references section above for vendor advisories and patch information. Affected products include: Argoproj Argo Cd.