A high-severity security vulnerability (CVE-2026-33671) affects the argo-workflows package due to an issue in the Picomatch JavaScript glob matcher. The vulnerability impacts versions prior to 4.0.15-r2 and can cause availability disruption. A patch is available in version 4.0.15-r2.