git

Sep 15, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 14, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 27, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 4, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ type AzureServicePrincipalCreds struct

+ func NewAzureServicePrincipalCreds(tenantID string, clientID string, clientSecret string, store CredsStore) AzureServicePrincipalCreds

+ func (a AzureServicePrincipalCreds) Environ() (io.Closer, []string, error)

+ func (a AzureServicePrincipalCreds) GetClientCertData() string

+ func (a AzureServicePrincipalCreds) GetClientCertKey() string

+ func (a AzureServicePrincipalCreds) GetUserInfo(_ context.Context) (string, string, error)

+ func (a AzureServicePrincipalCreds) HasClientCert() bool

+ func (a AzureServicePrincipalCreds) WithActiveDirectoryEndpoint(activeDirectoryEndpoint string) AzureServicePrincipalCreds

+ func (a AzureServicePrincipalCreds) WithClientCert(data string, key string) AzureServicePrincipalCreds

+ func (a AzureServicePrincipalCreds) WithNoProxy(noProxy string) AzureServicePrincipalCreds

+ func (a AzureServicePrincipalCreds) WithProxy(proxy string) AzureServicePrincipalCreds

type Client

+ LsSignatures func(revision string, deep bool) ([]RevisionSignatureInfo, string, error)

+ RepoURL func() string

type ClientOpts

+ func WithTagPrefix(prefix string) ClientOpts

+ type GPGVerificationResult string

+ const GPGVerificationResultBad

+ const GPGVerificationResultExpiredKey

+ const GPGVerificationResultExpiredSignature

+ const GPGVerificationResultGood

+ const GPGVerificationResultMissingKey

+ const GPGVerificationResultRevokedKey

+ const GPGVerificationResultUnsigned

+ const GPGVerificationResultUntrusted

+ type RevisionSignatureInfo struct

+ AuthorIdentity string

+ Date string

+ Revision string

+ SignatureKeyID string

+ VerificationResult GPGVerificationResult

Sep 14, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 27, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 31, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 9, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 18, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 28, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 6, 2026 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 5, 2026 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ func IsShortRef(revision string) bool

Apr 30, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Apr 21, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Apr 16, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Mar 27, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Mar 25, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Mar 19, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Mar 16, 2026 GO-2026-5418 +1 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Oct 12, 2026

Changes in this version

+ func SSHHostWithPort(repoURL string) string

type PublicKeysWithOptions

+ HostKeyAlgorithms []string

Oct 6, 2026

Changes in this version

+ func ValidateHTTPProxyURL(rawURL string) error

Aug 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 31, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 18, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 28, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 30, 2026 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 21, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 16, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 27, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 25, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 16, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 9, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Feb 22, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Feb 18, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Feb 2, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ var ErrNoNoteFound = errors.New("no note found")

+ func DiscoverGitHubAppInstallationID(ctx context.Context, appId int64, privateKey, enterpriseBaseURL, org string, ...) (int64, error)

+ func ExtractOrgFromRepoURL(repoURL string) (string, error)

type Client

+ AddAndPushNote func(sha string, namespace string, note string) error

+ GetCommitNote func(sha string, namespace string) (string, error)

+ HasFileChanged func(filePath string) (bool, error)

Jan 22, 2026 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 18, 2025 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 17, 2025 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 15, 2025 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 12, 2026 GO-2026-6701 +1 more

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 30, 2026 GO-2026-5418 +3 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 21, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 16, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 25, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Feb 18, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 22, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 14, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 13, 2026 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 24, 2025 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 18, 2025 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Nov 30, 2025 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ var BuiltinGitConfigEnv []string

type ClientOpts

+ func WithBuiltinGitConfig(enable bool) ClientOpts

Nov 4, 2025 GO-2026-5099 +4 more

  GO-2026-5099: ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-5618: Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Oct 20, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Oct 7, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 30, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 16, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 5, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 21, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Apr 16, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 25, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 22, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 13, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Dec 24, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Oct 17, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 30, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 22, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 18, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 10, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 5, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 4, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 4, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 25, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 13, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ type CommitMetadata struct

+ Author mail.Address

+ Body string

+ Date string

+ RepoURL string

+ SHA string

+ Subject string

type RevisionMetadata

+ References []RevisionReference

+ type RevisionReference struct

+ Commit *CommitMetadata

+ func GetReferences(logCtx *log.Entry, commitMessageBody string) ([]RevisionReference, string)

Jul 25, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 11, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 9, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 19, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 22, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 13, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jan 1, 2026 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Oct 17, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 30, 2025 GO-2026-5418 +2 more

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 22, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 18, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 5, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 4, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Sep 4, 2025 GO-2025-3993 +6 more

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Aug 25, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ var SupportedFIPSCompliantSSHKeyExchangeAlgorithms = []string

Jul 25, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 10, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jul 9, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 17, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 17, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 16, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Jun 9, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 29, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 28, 2025 GO-2025-3934 +7 more

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 21, 2025 GO-2025-3720 +8 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 19, 2025 GO-2025-3720 +8 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

May 14, 2025 GO-2025-3720 +8 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Mar 17, 2025 GO-2025-3720 +8 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

  GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd

  GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd

Changes in this version

+ var DefaultSSHKeyExchangeAlgorithms = SupportedSSHKeyExchangeAlgorithms

+ var ErrInvalidRepoURL = errors.New("repo URL is invalid")

+ var SupportedSSHKeyExchangeAlgorithms = []string

+ func GetRepoHTTPClient(repoURL string, insecure bool, creds Creds, proxyURL string, noProxy string) *http.Client

+ func IsCommitSHA(sha string) bool

+ func IsHTTPSURL(url string) bool

+ func IsHTTPURL(url string) bool

+ func IsSSHURL(url string) (bool, string)

+ func IsTruncatedCommitSHA(sha string) bool

+ func NormalizeGitURL(repo string) string

+ func NormalizeGitURLAllowInvalid(repo string) string

+ func SameURL(leftRepo, rightRepo string) bool

+ func TestRepo(repo string, creds Creds, insecure bool, enableLfs bool, proxy string, ...) error

+ type AzureWorkloadIdentityCreds struct

+ func NewAzureWorkloadIdentityCreds(store CredsStore, tokenProvider workloadidentity.TokenProvider) AzureWorkloadIdentityCreds

+ func (creds AzureWorkloadIdentityCreds) Environ() (io.Closer, []string, error)

+ func (creds AzureWorkloadIdentityCreds) GetAzureDevOpsAccessToken() (string, error)

+ func (creds AzureWorkloadIdentityCreds) GetUserInfo(_ context.Context) (string, string, error)

+ type Client interface

+ ChangedFiles func(revision string, targetRevision string) ([]string, error)

+ Checkout func(revision string, submoduleEnabled bool) (string, error)

+ CheckoutOrNew func(branch, base string, submoduleEnabled bool) (string, error)

+ CheckoutOrOrphan func(branch string, submoduleEnabled bool) (string, error)

+ CommitAndPush func(branch, message string) (string, error)

+ CommitSHA func() (string, error)

+ Fetch func(revision string) error

+ Init func() error

+ IsAnnotatedTag func(string) bool

+ IsRevisionPresent func(revision string) bool

+ LsFiles func(path string, enableNewGitFileGlobbing bool) ([]string, error)

+ LsLargeFiles func() ([]string, error)

+ LsRefs func() (*Refs, error)

+ LsRemote func(revision string) (string, error)

+ RemoveContents func() (string, error)

+ RevisionMetadata func(revision string) (*RevisionMetadata, error)

+ Root func() string

+ SetAuthor func(name, email string) (string, error)

+ Submodule func() error

+ VerifyCommitSignature func(string) (string, error)

+ func NewClient(rawRepoURL string, creds Creds, insecure bool, enableLfs bool, proxy string, ...) (Client, error)

+ func NewClientExt(rawRepoURL string, root string, creds Creds, insecure bool, enableLfs bool, ...) (Client, error)

+ type ClientOpts func(c *nativeGitClient)

+ func WithCache(cache gitRefCache, loadRefFromCache bool) ClientOpts

+ func WithEventHandlers(handlers EventHandlers) ClientOpts

+ type Creds interface

+ Environ func() (io.Closer, []string, error)

+ GetUserInfo func(ctx context.Context) (string, string, error)

+ type CredsStore interface

+ Add func(username string, password string) string

+ Environ func(id string) []string

+ Remove func(id string)

+ type EventHandlers struct

+ OnFetch func(repo string) func()

+ OnLsRemote func(repo string) func()

+ OnPush func(repo string) func()

+ type GenericHTTPSCreds interface

+ GetClientCertData func() string

+ GetClientCertKey func() string

+ HasClientCert func() bool

+ func NewGitHubAppCreds(appID int64, appInstallId int64, privateKey string, baseURL string, ...) GenericHTTPSCreds

+ func NewHTTPSCreds(username string, password string, bearerToken string, clientCertData string, ...) GenericHTTPSCreds

+ type GitHubAppCreds struct

+ func (g GitHubAppCreds) Environ() (io.Closer, []string, error)

+ func (g GitHubAppCreds) GetClientCertData() string

+ func (g GitHubAppCreds) GetClientCertKey() string

+ func (g GitHubAppCreds) GetUserInfo(ctx context.Context) (string, string, error)

+ func (g GitHubAppCreds) HasClientCert() bool

+ type GoogleCloudCreds struct

+ func NewGoogleCloudCreds(jsonData string, store CredsStore) GoogleCloudCreds

+ func (c GoogleCloudCreds) Environ() (io.Closer, []string, error)

+ func (c GoogleCloudCreds) GetUserInfo(_ context.Context) (string, string, error)

+ type HTTPSCreds struct

+ func (creds HTTPSCreds) BasicAuthHeader() string

+ func (creds HTTPSCreds) BearerAuthHeader() string

+ func (creds HTTPSCreds) Environ() (io.Closer, []string, error)

+ func (creds HTTPSCreds) GetClientCertData() string

+ func (creds HTTPSCreds) GetClientCertKey() string

+ func (creds HTTPSCreds) GetUserInfo(_ context.Context) (string, string, error)

+ func (creds HTTPSCreds) HasClientCert() bool

+ type NoopCredsStore struct

+ func (d NoopCredsStore) Add(_ string, _ string) string

+ func (d NoopCredsStore) Environ(_ string) []string

+ func (d NoopCredsStore) Remove(_ string)

+ type NopCloser struct

+ func (c NopCloser) Close() error

+ type NopCreds struct

+ func (c NopCreds) Environ() (io.Closer, []string, error)

+ func (c NopCreds) GetUserInfo(_ context.Context) (name string, email string, err error)

+ type PublicKeysWithOptions struct

+ KexAlgorithms []string

+ func (a *PublicKeysWithOptions) ClientConfig() (*ssh.ClientConfig, error)

+ func (a *PublicKeysWithOptions) Name() string

+ func (a *PublicKeysWithOptions) String() string

+ type Refs struct

+ Branches []string

+ Tags []string

+ type RevisionMetadata struct

+ Author string

+ Date time.Time

+ Message string

+ Tags []string

+ type SSHCreds struct

+ func NewSSHCreds(sshPrivateKey string, caPath string, insecureIgnoreHostKey bool, ...) SSHCreds

+ func (c SSHCreds) Environ() (io.Closer, []string, error)

+ func (c SSHCreds) GetUserInfo(_ context.Context) (string, string, error)

May 4, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

Apr 30, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

Apr 22, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

Mar 24, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

Mar 19, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd

Mar 17, 2025 GO-2025-3720 +6 more

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd

  GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd