Argo CD versions before 3.2.12, 3.3.10, and 3.4.2 contain an improper input neutralization vulnerability (CWE-79) in the UI component that renders link.argocd.argoproj.io/* annotations. Specifically, pipe-separated values from these annotations are used as href attributes in anchor elements without validating the URLs, enabling an attacker with application write access to inject javascript: URLs. This can lead to cross-site scripting attacks executed in the context of a higher-privileged authenticated user session. The vulnerability is addressed by fixes in versions 3.2.12, 3.3.10, and 3.4.2.

Successful exploitation allows an attacker with application write access to execute arbitrary JavaScript in the browser session of a higher-privileged authenticated Argo CD user. This can lead to compromise of user session, data theft, or unauthorized actions within the Argo CD web interface. The CVSS v3.1 base score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality and integrity impact.

This vulnerability is fixed in Argo CD versions 3.2.12, 3.3.10, and 3.4.2. Users should upgrade to one of these versions or later to remediate the issue. No vendor advisory is provided to indicate alternative mitigations or temporary workarounds. Patch status is confirmed by the version fixes stated in the description.