VDB

RHSA-2025%3A8278

RHSA-2025%3A8278 PUBLISHED CVSS 8.199999809265137 HIGH

A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session.

Risk Scores

CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

Affected Products

VendorProductVersions
Red Hatopenshift-gitops-1/argo-rollouts-rhel8@sha256:721d7cbb275153b809ab58848f93930ee72c99316544ce2c0bf7c9246f3c768c_s390x as a component of Red Hat OpenShift GitOps 1.16*
Red Hatopenshift-gitops-1/console-plugin-rhel8@sha256:a4e8ff1f135c636a67ddc90cb9f907d71b7b9df49818ebb1819e289154c9d0ac_ppc64le as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/console-plugin-rhel8@sha256:a4e8ff1f135c636a67ddc90cb9f907d71b7b9df49818ebb1819e289154c9d0ac_ppc64le
Red Hatopenshift-gitops-1/gitops-rhel8@sha256:064ee457d8654c3ca85684a2bdef3f07bba2e21afd27857e98284a287108f14b_s390x as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/gitops-rhel8@sha256:064ee457d8654c3ca85684a2bdef3f07bba2e21afd27857e98284a287108f14b_s390x
Red Hatopenshift-gitops-1/argo-rollouts-rhel8@sha256:5ec3f9ecac054ad51bf46e806ae7bf12fc16ff45af9ca29c3ae997b9ce165299_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argo-rollouts-rhel8@sha256:5ec3f9ecac054ad51bf46e806ae7bf12fc16ff45af9ca29c3ae997b9ce165299_arm64
Red Hatopenshift-gitops-1/argocd-rhel8@sha256:ddf1b016616ba297a8bfd962f390e84bd00a9d855fc3b87910cb866800374023_ppc64le as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argocd-rhel8@sha256:ddf1b016616ba297a8bfd962f390e84bd00a9d855fc3b87910cb866800374023_ppc64le
Red Hatopenshift-gitops-1/argocd-rhel8@sha256:33bd2d4b94056f4e3b732d7e0ef78f58ed0d4b3fe31e2a1bff2e26d5426b95f5_amd64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argocd-rhel8@sha256:33bd2d4b94056f4e3b732d7e0ef78f58ed0d4b3fe31e2a1bff2e26d5426b95f5_amd64
Red Hatopenshift-gitops-1/dex-rhel8@sha256:c92e995de334e4318c4993cd1faac5c307af31fa9378ac7fac0ebec4ae62a5c9_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/dex-rhel8@sha256:c92e995de334e4318c4993cd1faac5c307af31fa9378ac7fac0ebec4ae62a5c9_arm64
Red Hatopenshift-gitops-1/console-plugin-rhel8@sha256:e0dd5fa23e8aa5cb8b9ff221fc417cc1b93bcbe2e51a768590c25186c7b41bbf_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/console-plugin-rhel8@sha256:e0dd5fa23e8aa5cb8b9ff221fc417cc1b93bcbe2e51a768590c25186c7b41bbf_arm64
Red Hatopenshift-gitops-1/must-gather-rhel8@sha256:a741a5785a9502466d074cda2002bd63dc1955a844abcb7558e45a017c5045e0_ppc64le as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/must-gather-rhel8@sha256:a741a5785a9502466d074cda2002bd63dc1955a844abcb7558e45a017c5045e0_ppc64le
Red Hatopenshift-gitops-1/argo-rollouts-rhel8@sha256:b104df2409598b052bbd6bd768038f189bad29ca326386d8f5c997d70f45de69_amd64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argo-rollouts-rhel8@sha256:b104df2409598b052bbd6bd768038f189bad29ca326386d8f5c997d70f45de69_amd64
Red Hatopenshift-gitops-1/argo-rollouts-rhel8@sha256:aae8095403bd38e54074ec528f427218bb3794cde315df01b926f872311f6061_ppc64le as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argo-rollouts-rhel8@sha256:aae8095403bd38e54074ec528f427218bb3794cde315df01b926f872311f6061_ppc64le
Red Hatopenshift-gitops-1/gitops-rhel8@sha256:e0d4da573364c3412da85ec2ec38e105bd1c53db44cb62f9abc297427739c468_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/gitops-rhel8@sha256:e0d4da573364c3412da85ec2ec38e105bd1c53db44cb62f9abc297427739c468_arm64
Red Hatopenshift-gitops-1/argocd-rhel8@sha256:9640a72f66ffef7329b164734db8057be531ea280b4fb27709ffc58a129a15f6_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argocd-rhel8@sha256:9640a72f66ffef7329b164734db8057be531ea280b4fb27709ffc58a129a15f6_arm64
Red Hatopenshift-gitops-1/must-gather-rhel8@sha256:2f0dd107ba451c5e88eb9c89b5cb8c887499c8e95153a8eaaa3f486a0dc90307_amd64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/must-gather-rhel8@sha256:2f0dd107ba451c5e88eb9c89b5cb8c887499c8e95153a8eaaa3f486a0dc90307_amd64
Red Hatopenshift-gitops-1/gitops-rhel8-operator@sha256:5fffd4c7810ad8347cc0ce5c74512b5dfba20e498437b8b872c9f4020450b3a0_s390x as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/gitops-rhel8-operator@sha256:5fffd4c7810ad8347cc0ce5c74512b5dfba20e498437b8b872c9f4020450b3a0_s390x
Red Hatopenshift-gitops-1/argocd-extensions-rhel8@sha256:8807044d6ab60f36a7d15a281921a911d9749bf83c3de9a900322ef265a98bdf_s390x as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argocd-extensions-rhel8@sha256:8807044d6ab60f36a7d15a281921a911d9749bf83c3de9a900322ef265a98bdf_s390x
Red Hatopenshift-gitops-1/argocd-extensions-rhel8@sha256:e25f5fac790ac1056d7c6618331f8b50030f7da701b9be70974afd6240b7760f_arm64 as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/argocd-extensions-rhel8@sha256:e25f5fac790ac1056d7c6618331f8b50030f7da701b9be70974afd6240b7760f_arm64
Red Hatopenshift-gitops-1/gitops-operator-bundle@sha256:432bb516e3e7a06087f3f40b2455845a1009ff22f030b120dc01fbbd1715be02_amd64 as a component of Red Hat OpenShift GitOps 1.16*
Red Hatopenshift-gitops-1/must-gather-rhel8@sha256:2edc9ba7f87bb47d718a8cfb9e62b7d3c83d0920992c3cb13403be78042f5222_s390x as a component of Red Hat OpenShift GitOps 1.16openshift-gitops-1/must-gather-rhel8@sha256:2edc9ba7f87bb47d718a8cfb9e62b7d3c83d0920992c3cb13403be78042f5222_s390x
Red Hatopenshift-gitops-1/dex-rhel8@sha256:65cb265ba3180c0f8e198bce2bb305e62a7b1b8d9a2e649c44129eeee2977a84_amd64 as a component of Red Hat OpenShift GitOps 1.16*

…and 15 more

Timeline

  • May 28, 2025 CVE Published
  • Apr 29, 2026 CVE Updated
  • Apr 29, 2026 Distribution Patch
  • Apr 29, 2026 Distribution Patch
  • Apr 29, 2026 Security Advisory
  • Apr 29, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›