CVE-2025-47933
CRITICALArgoproj Argo CD < 2.13.8 - XSS
Title source: ruleDescription
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
Exploits (1)
github
WORKING POC
by manus-use · postscriptpoc
https://github.com/manus-use/cve-pocs/tree/main/argo-cd-CVE-2025-47933
Scores
CVSS v3
9.0
EPSS
0.0007
EPSS Percentile
20.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-79
Status
published
Products (5)
argoproj/argo-cd
0 - 3.0.4Go
argoproj/argo-cd
1.2.0-rc1Go
argoproj/argo-cd
2.0.0-rc3 - 2.13.8Go
argoproj/argo_cd
1.2.0 rc1 (2 CPE variants)
argoproj/argo_cd
1.2.1 - 2.13.8
Published
May 29, 2025
Tracked Since
Feb 18, 2026