CVE-2026-113708: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in argoproj argo-cd

Argo CD versions 2.7.0 through before 3.3.15, 3.4.0-rc1 through before 3.4.10, 3.5.0-rc1 through before 3.5.4, and 3.6.0-rc1 through before 3.6.0-rc2 contain an argument injection vulnerability (CWE-88) due to improper neutralization of argument delimiters in Kustomize's handling of ref or version query values passed to git fetch. When using the local file:// transport, a specially crafted leading-hyphen value can be interpreted as a git option (--upload-pack), enabling execution of arbitrary commands inside the argocd-repo-server pod. This command runs with repo-server user privileges, can access repository credentials and other sensitive data, and can exfiltrate data via manifest-generation errors. Exploitation requires only Application get permission on an existing Application, without update, sync, or repository write permissions. The vulnerability is fixed in Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

Successful exploitation allows an attacker with limited permissions (Application get) to execute arbitrary commands inside the argocd-repo-server pod. This can lead to disclosure of repository credentials and other sensitive process-accessible data, as well as potential further compromise of the Argo CD environment. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 9.9 (critical).

Upgrade Argo CD to one of the fixed versions: 3.3.15, 3.4.10, 3.5.4, or 3.6.0-rc2. These versions include the necessary fix to properly neutralize argument delimiters and prevent command injection. Replacing only the Kustomize component with a newer version is insufficient to mitigate this issue. No other mitigations are indicated by the vendor advisory.