Impact
When Kustomize Helm chart rendering is enabled, a kustomization can point Helm at a directory the repository controls and run a program from that directory inside argocd-repo-server. Kustomize copies helmGlobals.configHome into Helm’s config and data directories. Helm then loads a downloader plugin from <configHome>/.data/plugins with no separate plugin-install step, and runs it when a helmCharts repository URL uses that plugin’s protocol. The command runs as the repo-server user and can read repository credentials and anything else available to that process.

All versions from v2.1.0 onward are affected, including every currently supported release. v2.0.5 and earlier are not. The behavior was introduced in b6d5c23bc (2021-04-20, #6059), the change that upgraded the bundled Kustomize from 3.9.4 to 4.1.2, and was first released in v2.1.0. Kustomize 4.1.0 is what first passes helmGlobals.configHome through to Helm (kubernetes-sigs/kustomize#3784). Deployments that do not pass --enable-helm to kustomize build are not affected.

Two ways to supply the kustomization, both of which require that an operator has already enabled --enable-helm:

Commit it to a Git repository that an Application builds with Kustomize.
Upload it through POST /api/v1/applications/manifestsWithFiles (argocd app diff --local --server-side-generate). This needs only Application get on an existing Application. It does not need permission to update or sync the Application, or write access to its Git repository.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:

v3.6.0-rc2
v3.5.4
v3.4.10
v3.3.15
Kustomize Helm chart rendering still works for ordinary http, https, and oci chart repositories. The patch points Helm at an empty config and data directory for every Kustomize build, so helmGlobals.configHome cannot register a plugin.

Workarounds
Do not pass --enable-helm in kustomize.buildOptions. That is a complete workaround for this issue. Applications that render Helm charts through Kustomize cannot use it.

Restricting Application get, or blocking POST /api/v1/applications/manifestsWithFiles, closes only the upload path. A kustomization committed to Git is still built on the next sync while --enable-helm is set.

Credits
The Argo CD team would like to thank @hoang-prod for responsibly disclosing this issue according to our security reporting guidelines (https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).

References
Introducing commit: b6d5c23bce2f8a46c52975ba438a3b93d242d96c (#6059), first released in v2.1.0
Kustomize feature: kubernetes-sigs/kustomize#3784
Kustomizing Helm charts: https://argo-cd.readthedocs.io/en/stable/user-guide/kustomize/#kustomizing-helm-charts