Withdrawn by the publisher.

Affected: CleanStart: argo-cd

Multiple security vulnerabilities affect the argo-cd package. These issues are resolved in later releases. See references for individual vulnerability details.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Affected: Go: github.com/argoproj/argo-cd/v3, Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd

### Summary

A user with **application write access (developer role)** can set `link.argocd.argoproj.io/*` annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab's **URLs section** as `<a href>` elements without URL validation. Using the pipe-separator trick (`Display Text | javascript:...`), an attacker can inject a `javascript:` URI while displaying a legitimate-looking label (e.g. `GitHub Repo`). When a higher-privileged user (admin) clicks the link, **arbitrary JavaScript executes in the ArgoCD origin context** in the admin's authenticated session context, enabling API exfiltration and privilege escalation from developer to admin.

### Details

**Vulnerable sink:** `ui/src/app/applications/components/application-summary/application-summary.tsx:277`

```tsx const parts = (url || '').split('|'); <a key={i} href={parts.length > 1 ? parts[1] : parts[0]} target='_blank'> {parts[0]} </a> ```

The annotation value is split on `|`. `parts[0]` becomes the visible link label; `parts[1]` becomes the `href`. **No call to `isValidURL()` is made**, unlike the protected `ApplicationURLs` component (`application-urls.tsx:72,80`) which does validate URLs and blocks `javascript:`. The `target='_blank'` opens a new tab that inherits the ArgoCD origin, giving the injected script same-origin fetch access to all ArgoCD APIs using the victim's authenticated session (credentialed `fetch()` calls).

**Root cause:** React 16.x does not block `javascript…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Argo CD ausnutzen, um Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen, wodurch potenziell Administratorrechte erlangt werden können.