Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Picomatch library in argo-workflows and renovate can be abused

published 5 days ago
Summary

The JavaScript component called Picomatch, used inside the argo‑workflows and renovate tools, can be tricked into processing malicious patterns. This could allow an attacker to cause unexpected behavior or gain limited access to the system running these tools. Update the affected tools to the latest versions that include the corrected Picomatch code, or replace Picomatch with a safer alternative if an update is not yet available.

What to do
  • Update cleanstart argo-workflows to version 3.7.15-r0.
  • Update cleanstart argo-workflows to version 3.7.16-r1.
  • Update cleanstart argo-workflows to version 3.7.17-r0.
  • Update cleanstart renovate to version 43.180.0-r1.
  • Update cleanstart renovate to version 43.177.9-r1.
  • Update cleanstart renovate to version 43.181.2-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart argo-workflows < 3.7.15-r0
< 3.7.16-r1
< 3.7.17-r0
Fix: upgrade to 3.7.15-r0
CleanStart cleanstart renovate < 43.180.0-r1
< 43.177.9-r1
< 43.181.2-r1
Fix: upgrade to 43.180.0-r1
Original advisory text
Picomatch is a glob matcher written JavaScript
CVE-2026-33671 affects multiple packages. Picomatch is a glob matcher written JavaScript. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-ZY80781 · OSV
Track software like this
Free during beta