A high-severity security vulnerability exists in the argo-workflows package due to its use of Forge (node-forge), a native JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are affected. The vulnerability does not impact confidentiality or integrity but results in high impact on availability. A fix is available in version 4.0.15-r2.
A security vulnerability in the argo-workflows package involves the brace-expansion library, which generates arbitrary strings containing a common prefix and suffix. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a high severity score and impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A security vulnerability exists in the argo-workflows package due to an issue in Picomatch, a JavaScript glob matcher. The vulnerability affects versions prior to 4.0.15-r2. It has a medium severity with a CVSS score of 5.3 and impacts integrity without affecting confidentiality or availability. A patch is available in version 4.0.15-r2.
A high-severity security vulnerability (CVE-2026-33671) affects the argo-workflows package due to an issue in the Picomatch JavaScript glob matcher. The vulnerability impacts versions prior to 4.0.15-r2 and can cause availability disruption. A patch is available in version 4.0.15-r2.
A critical security vulnerability (CVE-2026-33228) affects the argo-workflows package due to an issue in the flatted circular JSON parser. Versions prior to 4.0.15-r2 are vulnerable. The flaw has a high severity CVSS score of 9.8, indicating it allows remote attackers to cause complete confidentiality, integrity, and availability compromise. A fix is available in version 4.0.15-r2.
A high-severity vulnerability (CVE-2026-32141) affects the argo-workflows package due to an issue in the flatted circular JSON parser. This vulnerability impacts versions prior to 4.0.15-r2 and can cause a denial of service (availability impact) without compromising confidentiality or integrity. A patch is available in version 4.0.15-r2.
CVE-2026-29063 is a critical security vulnerability in the argo-workflows package affecting all versions prior to 4.0.15-r2. It has a CVSS score of 9.8, indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. A fix is available in version 4.0.15-r2.
A high-severity security vulnerability exists in the argo-workflows package due to an issue in the minimatch utility, which converts glob expressions into JavaScript RegExp objects. The vulnerability affects versions prior to 4.1.6-r1 and 4.0.15-r2. It has a CVSS score of 7.5 with an impact on availability. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity security vulnerability affects the argo-workflows package due to an issue in the minimatch utility, which converts glob expressions into JavaScript regular expressions. The vulnerability impacts availability and does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A high-severity security vulnerability (CVE-2026-26996) affects the argo-workflows package due to an issue in the minimatch utility, which converts glob expressions into JavaScript RegExp objects. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A high-severity security vulnerability (CVE-2026-24001) affects the argo-workflows package due to an issue in the jsdiff JavaScript text differencing implementation. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.
A medium severity vulnerability (CVE-2026-14631) affects the argo-workflows package due to issues in webpack-dev-server versions 5. The flaw impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address this issue.
A security vulnerability (CVE-2026-14620) affects the argo-workflows package due to issues in webpack-dev-server versions 5. The flaw has a medium severity score of 4.7 and impacts availability without compromising confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address this vulnerability.
A high-severity security vulnerability (CVE-2026-14257) affects the argo-workflows package related to brace-expansion versions through 5. The flaw impacts availability but not confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address the issue.
A high-severity security vulnerability (CVE-2026-13311) affects the argo-workflows package due to an issue in the shell-quote dependency prior to version 1. This vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address the issue.
CVE-2026-13149 is a high-severity security vulnerability in the argo-workflows package related to brace-expansion through version 5. The flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. A fix is available in these versions. The vulnerability has a CVSS 4.0 score of 8.7, indicating a significant impact if exploited.
A security vulnerability identified as CVE-2026-12590 affects the argo-workflows package through body-parser versions prior to 1. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address this issue.
A high-severity security vulnerability (CVE-2026-12143) affects the argo-workflows package through the form-data library used for creating multipart/form-data streams. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a high impact on integrity without requiring privileges or user interaction. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.
A high-severity vulnerability exists in the argo-workflows package due to an issue in the Forge (node-forge) JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are affected. The vulnerability does not impact confidentiality or integrity but causes a denial of service (availability impact). A fix is available in version 4.0.15-r2.
A high-severity security vulnerability affects the argo-workflows package due to an issue in the Forge (node-forge) JavaScript implementation of Transport Layer Security. Versions prior to 4.0.15-r2 are impacted. The vulnerability has a CVSS score of 7.4, indicating high impact on confidentiality and integrity. A patch is available in version 4.0.15-r2.