Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Argo Workflows unsafe brace expansion can run code

published 1 month ago
Summary

The Argo Workflows package processes brace patterns in a way that can be tricked into executing unintended commands. This could let an attacker cause the system to run code they control, potentially compromising your workflow environment. Update to the latest version of Argo Workflows or apply the vendor’s recommended patch to stop the risky processing.

What to do
  • Update cleanstart argo-workflows to version 4.0.12-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart argo-workflows < 4.0.12-r1
Fix: upgrade to 4.0.12-r1
Original advisory text
brace-expansion through 5
Security vulnerability affects the argo-workflows package. brace-expansion through 5.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published29 Sep 2026
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CLEANSTART-2026-NJ03558 · OSV
Track software like this
Free during beta