A command injection vulnerability exists in Argo CD Image Updater where a proxy URL configured on an SSH Git repository is unsanitized and passed into a shell-interpreted SSH command. This allows an attacker who can set a malicious proxy value to inject shell metacharacters, execute arbitrary commands, and access credentials within the Image Updater process context.