CVE-2025-66626
HIGH8.1EPSS 0.09%RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
發布日:2025/12/9修改日:2026/2/4
描述
RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
受影響套件(6)
- Bitnami/argo-workflowsfrom 0, < 2.5.3, >= 3.0.0, < 3.6.14
- Go/github.com/argoproj/argo-workflowsfrom 0, <= 2.5.3-rc4
- Go/github.com/argoproj/argo-workflowsfrom 0
- Go/github.com/argoproj/argo-workflows/v2from 0
- Go/github.com/argoproj/argo-workflows/v3>= 3.7.0, < 3.7.5
- Go/github.com/argoproj/argo-workflows/v3from 0, < 3.6.14, >= 3.7.0, < 3.7.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
參考連結(6)
- ADVISORYhttps://github.com/advisories/GHSA-p84v-gxvw-73pf
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-66626
- PATCHhttps://github.com/argoproj/argo-workflows
- WEBhttps://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037
- WEBhttps://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1
- WEBhttps://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh