argocd-image-updater vulnerabilities

CVEs whose affected-version data names the argocd-image-updater package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-121621High· 8.8

3d ago

Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can i…

▾ TwilightRed Hat · argocd-image-updaterEPSS 1.8%via CVEORG