The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a command injection vulnerability due to improper sanitization of user-controlled input passed to a shell command in a Kubernetes operator task. This vulnerability allows an attacker with high privileges to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.7.
CVE-2026-18390 is an OS command injection vulnerability in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows, Linux, and iOS platforms. It affects versions before 5.4.20 and 5.4.21. The vulnerability arises from improper neutralization of special elements used in OS commands, allowing potential command injection. The CVSS 3.1 score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, so patch status is not confirmed.
CVE-2026-105407 is an OS Command Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-40 and 17.5-1 through 17.5-31. This flaw allows an attacker with limited privileges to execute arbitrary commands on the affected server without user interaction. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-101947 is a high-severity OS command injection vulnerability in CellHubs ExifTool for photo and video version 5.0.1-gms. The vulnerability arises because the software constructs shell command strings from file paths without properly escaping embedded single quotes, specifically in the CSV-export functionality. This improper neutralization of special elements (CWE-78) allows an attacker to inject arbitrary commands via crafted file paths. The vulnerability requires local access with user interaction and has no known exploits in the wild.
### Impact
Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server.
All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and earlier are not. The behavior was introduced in [9b27aeb1a4](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) (2024-01-09, [#15864](https://github.com/argoproj/argo-cd/pull/15864)), the change that added SOCKS5 proxy support for SSH Git URLs, and was first released in v2.11.0.
The repository must use SSH. `http`, `https`, and `socks5` proxy URLs all take this path when they are set on an SSH repository. An HTTPS Git repository uses the proxy as an HTTP proxy and does not build this command.
Anyone who can create or update a repository or a repository credential template can set the proxy. That includes a project-scoped repository permission, `argocd repo add --proxy`, and a repository Secret. A credential template applies its proxy to every matching SSH repository that does not have its own credentials. Argo CD runs the command when it tests the repository connection and on later fetches. The process can read other Git, Helm, and OCI credentials stored for the repo-server.
### Patches
A patch for this vulnerability has been released in the following Argo CD versions:
* v3.6.0-rc2
* v3.5.4
* v3.4.10
* v3.3.15
The fix stops passing the proxy host and port through a shell.
Argo CD 2.x and 3.0 through 3.2 are out of support and will not receive a patch. Upgrade to a patched 3.3 or newer release.
### Workarounds
There is no setting that keeps SSH repository proxies and removes the shell command.
* Do not grant repository create or update to untrusted users, including project-scoped repository access. See [RBAC resources](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-model-structure) and [project-scoped repositories](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters).
* Do not set a proxy on an SSH repository or on a credential template that matches SSH repositories. The proxy field is documented in [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy). Credential templates are documented in [Credential templates](https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#credential-templates). The `--proxy` flag is documented in [`argocd repo add`](https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd_repo_add/).
An HTTPS Git repository with an HTTP proxy does not use this command. Review existing repository and credential-template Secrets for unexpected `proxy` values.
### Credits
The Argo CD team would like to thank @kamil-sawicki, @yuvalelarat, @cherez0ff, @McCaulay, @gehan-psbc, @ria-labs-security, @parameter-ai-security, and @zwindler for responsibly disclosing this issue according to our [security reporting guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).
### References
* Introducing commit: [9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) ([#15864](https://github.com/argoproj/argo-cd/pull/15864)), first released in v2.11.0
* [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy)
### For more information
* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
IBM Guardium Data Protection versions 12.2.2 and 12.1 contain an OS command injection vulnerability (CWE-78) that could allow a remote attacker to execute arbitrary commands. The vulnerability arises from improper neutralization of special elements used in OS commands. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.
CVE-2026-106126 is a critical OS command injection vulnerability in the Active Directory Events Listener component of Tenable Identity Exposure (SaaS). It allows an authenticated user with low privileges to execute arbitrary commands with SYSTEM-level privileges on the Primary Domain Controller emulator (PDCe). This vulnerability affects versions from 0 up to but not including 3.126.0 and has a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability.
IBM Guardium Data Protection 12.2 contains a command injection vulnerability in the SUID-root ssh_config_wrapper component. This flaw allows an authenticated high-privileged user to inject arbitrary commands, which are executed with root privileges. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity.
CVE-2026-93858 is a high-severity OS command injection vulnerability in OpenStack Mistral up to version 23.0.0. The vulnerability arises because the std.ssh_proxied action passes a user-supplied proxy_command directly to paramiko.ProxyCommand() without sanitization. An authenticated project member can exploit this to execute arbitrary local commands on the executor host under the executor's service account. This affects Mistral deployments that allow the std.ssh_proxied action, which is enabled by default.
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and from 10.0.0 through 10.0.0a1. This occurs when an administrator deletes an account, triggering an internal routine that cleans up cryptographic keys. Malformed account names can include shell metacharacters that lead to command injection.
A command injection vulnerability exists in the WebTools administrative interface of Brocade Fabric OS. It affects versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can exploit this to execute arbitrary shell commands with root privileges on the switch.
An OS command injection vulnerability exists in the PAM session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with a username or profile identifier containing shell metacharacters can execute arbitrary commands with root privileges when their SSH session ends.
An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. This flaw allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions by supplying specially crafted parameters containing shell metacharacters when configuring SSH known host settings.
Brocade Fabric versions before 9.2.2d and from 10.0.0 through 10.0.0a1 contain a vulnerability in the handling of specific download protocols. Unsanitized parameter strings are used to construct system command strings executed by the firmware management daemon. This allows an attacker with elevated privileges to execute arbitrary shell commands due to lack of input sanitization on fields such as host or file path.
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. This flaw allows arbitrary operating system commands to be executed when an administrator initiates a configuration download using a malicious or compromised configuration file. The vulnerability arises because the management daemon relays user-supplied parameters directly to an internal utility script without proper sanitization of shell metacharacters.
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. This flaw allows an authenticated user with low-privilege administrative access to execute arbitrary shell commands with elevated privileges by submitting crafted timezone strings containing shell metacharacters via the REST API or configuration download routines.
An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The vulnerability arises because the binary does not properly sanitize user-supplied input options when invoking system commands via a shell interpreter. A privileged user with maintenance account access can exploit this flaw to execute arbitrary OS commands with root privileges.