Bug 2367740 (CVE-2025-47933)

Summary:	CVE-2025-47933 argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	alcohan, anjoseph, gparvin, jprabhak, manissin, njean, owatkins, pahickey, rhaigner, security-response-team, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-05-28

Description OSIDB Bzimport 2025-05-21 08:00:17 UTC

The vulnerability stems from improper sanitization of repository URLs in Argo CD's UI. Specifically, the frontend logic fails to filter out javascript: protocol injections, allowing a user with permission to edit a repository to inject malicious URLs. When viewed by another authenticated user, this could result in execution of arbitrary JavaScript in the victim's browser, potentially allowing unauthorized actions through the victim's session.The issue is addressed in Argo CD versions 3.0.2, 2.14.12, and 2.13.8.