CVE-2021-37914

MEDIUM6.5EPSS 0.27%

Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows

Published: 8/9/2021Modified: 4/3/2025

Also known as:GHSA-h563-xh25-x54qBIT-argo-workflows-2021-37914GO-2022-0928

Description

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

Affected packages (5)

Bitnami/argo-workflowsfrom 0, < 3.1.4
Go/github.com/argoproj/argo-workflowsfrom 0
Go/github.com/argoproj/argo-workflows/v2from 0
Go/github.com/argoproj/argo-workflows/v3>= 3.1.0, < 3.1.6
Go/github.com/argoproj/argo-workflows/v3>= 3.1.0, < 3.1.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-37914
PATCHgithub.com/argoproj/argo-workflows/v3
WEBhttps://github.com/argoproj/argo-workflows/commit/2a2ecc916925642fd8cb1efd026588e6828f82e1
WEBhttps://github.com/argoproj/argo-workflows/issues/6441
WEBhttps://github.com/argoproj/argo-workflows/pull/6285
WEBhttps://github.com/argoproj/argo-workflows/pull/6442
WEBhttps://github.com/argoproj/argo-workflows/security/advisories/GHSA-h563-xh25-x54q