Vulnerability Database

308,681

Total vulnerabilities in the database

CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.

Published: Mar 3, 2021
Updated: Nov 16, 2025
CVE: CVE-2021-23347
GHSA: GHSA-qq5v-f4c3-395c
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.7
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
github.com/argoproj/argo-cd/v2	-	1.7.13
github.com/argoproj/argo-cd/v2	1.8.0	1.8.6
argoproj / argo_cd	1.8.0	1.8.6
argoproj / argo_cd	-	1.7.13

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo