A high-severity security vulnerability (CVE-2026-59869) affects the argo-workflows package due to an issue in the js-yaml JavaScript YAML parser and dumper. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address the issue.
A high-severity security vulnerability (CVE-2026-55602) affects the argo-workflows package due to an issue in the http-proxy-middleware component used in Node.js environments. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a complete compromise of integrity without affecting confidentiality or availability. The vulnerability has been fixed in versions 4.1.6-r1 and 4.0.15-r2.
A security vulnerability (CVE-2026-54490) affects the argo-workflows package, specifically in the websocket-driver component, which is a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity security vulnerability (CVE-2026-54466) affects the argo-workflows package's websocket-driver component, a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a high impact on integrity without requiring privileges or user interaction. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A security vulnerability in the argo-workflows package's launch-editor feature allows users to open files with line numbers in an editor from Node. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available to address the issue.
A security vulnerability has been identified in the argo-workflows package due to its use of the js-yaml JavaScript YAML parser and dumper. The vulnerability affects versions prior to 4.1.6-r1 and 4.0.15-r2. It has a CVSS 3.1 base score of 5.3, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but can cause availability issues. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity security vulnerability (CVE-2026-48779) affects the argo-workflows package, which uses the ws WebSocket client and server for Node.js. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It has a CVSS score of 7.5 with an impact on availability. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A security vulnerability in the argo-workflows package causes the generation of a faulty regular expression when three or more parameters are present within a single segment separated by characters other than a period. This flaw can lead to a high-severity impact on availability. The issue affects versions prior to 4.1.6-r1 and 4.0.15-r2 and has been addressed in these fixed releases.
A high-severity security vulnerability (CVE-2026-45822) affects the argo-workflows package, specifically in versions prior to 4.1.6-r1 and 4.0.15-r2. The flaw involves the decode-uri-component functionality. A fix is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity security vulnerability (CVE-2026-45819) affects the argo-workflows package, specifically impacting versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant risk. A patch is available in versions 4.1.6-r1 and 4.0.15-r2 to address this issue.
A high-severity security vulnerability (CVE-2026-45736) affects the argo-workflows package, specifically related to the ws library, an open source WebSocket client and server for Node.js. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows remote attackers to cause a confidentiality breach without requiring authentication or user interaction. A patch is available to address this issue.
CVE-2026-44728 is a high-severity security vulnerability affecting the argo-workflows package, related to the Babel JavaScript compiler. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker with local access and no privileges to execute actions requiring user interaction, potentially leading to full confidentiality, integrity, and availability compromise. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A security vulnerability identified as CVE-2026-41988 affects the argo-workflows package, specifically versions before 4.1.6-r1 and 4.0.15-r2. The issue relates to the uuid component before version 14. The vulnerability has a low severity score and does not impact confidentiality or availability but may cause limited integrity issues. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A high-severity vulnerability (CVE-2026-41907) affects the argo-workflows package related to the uuid component used for creating RFC9562 (formerly RFC4122) UUIDs. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability does not affect confidentiality or availability but allows unauthorized modification (integrity impact). A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity security vulnerability (CVE-2026-40895) affects the argo-workflows package versions prior to 4.0.15-r2. The issue involves the follow-redirects module, a drop-in replacement for Node's http and https modules that automatically follows redirects. A fix is available in version 4.0.15-r2.
A security vulnerability exists in the argo-workflows package affecting versions of the @tootallnate/once package before version 3. The affected versions of argo-workflows are prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a low severity score and impacts availability without affecting confidentiality or integrity. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A high-severity vulnerability in the argo-workflows package involves insecure serialization of JavaScript to a JSON superset that supports regular expressions and functions. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A critical security vulnerability (CVE-2026-33896) affects the argo-workflows package due to an issue in the Forge (node-forge) JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are impacted. The vulnerability has a high CVSS score of 9.1, indicating it allows remote attackers to compromise confidentiality and integrity without user interaction or privileges. A fix is available in version 4.0.15-r2.
A high-severity vulnerability exists in the argo-workflows package due to a flaw in the Forge (node-forge) JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are affected. The vulnerability allows unauthorized modification of data without impacting confidentiality or availability. A fix is available in version 4.0.15-r2.
A high-severity security vulnerability exists in the argo-workflows package due to its use of Forge (node-forge), a native JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are affected. The vulnerability allows unauthorized modification of data without impacting confidentiality or availability. A patch is available in version 4.0.15-r2.