Impact
Argo CD evaluates .jsonnet files inside the repo-server with an importer that can open any path the process can read. import, importstr, and importbin all use that importer. An absolute path such as /proc/self/environ, a ../ traversal, or a symlink inside the repository that points outside it is opened with the repo-server’s own filesystem permissions. importstr of a device such as /dev/zero reads until the process runs out of memory. Argo CD redacts generated Secrets, so placing the file contents in a ConfigMap returns them to the caller. The data can include the process environment, the projected service-account token, mounted private keys, and repository credentials.

All versions from v0.9.0 onward are affected, including every currently supported release. v0.8.2 and earlier are not. The behavior was introduced in 27471d524 (2018-09-07, #561), the change that added Jsonnet as an application source, and was first released in v0.9.0. The import path was limited to a search list for relative paths. That list does not apply to absolute paths.

Two ways to supply the file:

Commit a .jsonnet file to a Git repository that an Application builds. Directory applications evaluate every .jsonnet file in the application directory.
Upload it through POST /api/v1/applications/manifestsWithFiles (argocd app diff --local --server-side-generate). This needs only Application get on an existing directory Application. It does not need permission to update or sync the Application, or write access to its Git repository.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:

v3.6.0-rc2
v3.5.4
v3.4.10
v3.3.15
Imports that stay inside the repository still work. The patch resolves each import, including symlinks, and rejects any path outside the repository root. It also rejects anything that is not a regular file, so a device file is not read.

Workarounds
Set jsonnet.enable to "false" in the argocd-cm ConfigMap. Argo CD then skips .jsonnet files. That covers a file committed to Git and a file uploaded through POST /api/v1/applications/manifestsWithFiles. YAML and JSON in a directory application are still applied. An application that depends on Jsonnet stops rendering those files: they are omitted rather than rejected, so a directory that contains only Jsonnet syncs without those manifests.

Credits
The Argo CD team would like to thank @hoang-prod, @arpitjain099, @key-moon, @MopMonkAI, @Kushalkhemka, @PontusHanssen, @mayank-jangid-moon, @skigeek16, @opensec-intelligence, @thevilledev, @ShadowByte1, @izhax, @mikecole-mg, @jake-ciolek, and @vitorespf for responsibly disclosing this issue according to our security reporting guidelines (https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).

References
Introducing commit: 27471d524958878e7acc5131fb466b292079cd05 (#561), first released in v0.9.0