Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for argos-javascript by argos-ci

    CVE-2026-59960 (GCVE-0-2026-59960)

    Vulnerability from nvd – Published: 2026-09-14 16:59 – Updated: 2026-09-14 20:06
    VLAI
    Title
    Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core
    Summary
    Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-14 19:21 UTC
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7642 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:21:23.518385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:06:29.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "argos-javascript",
          "vendor": "argos-ci",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:59:28.726Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/pull/319",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/pull/319"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/core@6.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/core@6.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4x45-gxvp-6283",
        "discovery": "UNKNOWN"
      },
      "title": "Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59960",
    "datePublished": "2026-09-14T16:59:28.726Z",
    "dateReserved": "2026-07-07T18:49:15.608Z",
    "dateUpdated": "2026-09-14T20:06:29.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-59960 (GCVE-0-2026-59960)

    Vulnerability from cvelistv5 – Published: 2026-09-14 16:59 – Updated: 2026-09-14 20:06
    VLAI
    Title
    Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core
    Summary
    Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-14 19:21 UTC
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7642 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59960",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:21:23.518385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:06:29.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "argos-javascript",
          "vendor": "argos-ci",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:59:28.726Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/pull/319",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/pull/319"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717"
        },
        {
          "name": "https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/core@6.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/core@6.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4x45-gxvp-6283",
        "discovery": "UNKNOWN"
      },
      "title": "Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59960",
    "datePublished": "2026-09-14T16:59:28.726Z",
    "dateReserved": "2026-07-07T18:49:15.608Z",
    "dateUpdated": "2026-09-14T20:06:29.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}