argos-ci argos-javascript vulnerabilities

Latest argos-ci argos-javascript CVEs

Newest publication first

1. CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

   Published 2026-09-14

   High·CVSS 7.5 EPSS 0.64%

   Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is fals...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.