CVE-2021-23347: XSS Vulnerability in github.com/argoproj/argo-cd/v2
Summary
CVE-2021-23347: Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2. Affects github.com/argoproj/argo-cd/v2 across 2 version ranges.
< 1.7.13
>= 1.8.0, < 1.8.6
Fixed in 1.7.13 or 1.8.6, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/argoproj/argo-cd · Go
- argo-cd · Bitnami
The same CVE-2021-23347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/argoproj/argo-cd/v2 is a Go package that provides a command-line interface (CLI) for Argo CD, a declarative continuous delivery tool for Kubernetes. The CLI allows users to interact with Argo CD and perform various operations. This package is vulnerable to a cross-site scripting (XSS) attack when using single sign-on (SSO) with the CLI.
Vulnerability Detail
The vulnerability arises when a malicious SSO provider sends a specially crafted error message that contains arbitrary JavaScript code. When this error message is displayed on the client-side, the JavaScript code gets executed, leading to XSS. Exploiting this vulnerability requires Argo CD to be connected to a compromised or malicious SSO provider. The severity of this vulnerability is considered moderate with a CVSS score of 4.7.
How To Fix
Latest published version: v2.14.21 as of 22 Oct 2026
go get github.com/argoproj/argo-cd/v2@v2.14.21Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.131.7.13go get github.com/argoproj/argo-cd/v2@v1.7.13 -
>= 1.8.0, < 1.8.61.8.6go get github.com/argoproj/argo-cd/v2@v1.8.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you do not trust your SSO provider, it is advised not to use SSO with the CLI. By avoiding SSO, you can eliminate the potential risk of a compromised or malicious SSO provider exploiting this vulnerability.
Conclusion
The XSS vulnerability in github.com/argoproj/argo-cd/v2 when using SSO with the CLI can be mitigated by updating to the latest versions of Argo CD. It is important to stay up-to-date with security patches to protect against potential exploitation. If you have any further questions or need assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/argoproj/argo-cd/v2 →
FAQ
The impact of this vulnerability is that a malicious SSO provider could execute arbitrary JavaScript code on the client-side, potentially leading to unauthorized access, data theft, or other malicious activities.
You can check if your Argo CD installation is affected by this vulnerability by using the Vulert Playground at Vulert Scanner. Simply enter your application details, and Vulert will analyze your dependencies to identify any open-source vulnerabilities, including this XSS vulnerability.
Yes, if you do not trust your SSO provider, you can avoid using SSO with the CLI. This eliminates the potential risk of exploitation through a compromised or malicious SSO provider.
This vulnerability was discovered during static code scanning with CodeQL and fixed by the Argo CD team. Adam Gold of Snyk correctly classified it as a security issue and helped determine its severity.
For more information or support regarding this vulnerability, you can open an issue in the Argo CD issue tracker or discussions on GitHub. You can also join the Argo CD community on Slack in the #argo-cd channel.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/argoproj/argo-cd/v2.
