Affected by GO-2025-3720
and 8 other vulnerabilities
GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd
GO-2025-3934: Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd
GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd
GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd
GO-2025-3995: Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd
GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd
GO-2026-5418: Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd
GO-2026-6701: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd
GO-2026-6784: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd
NewRepoClientFactory creates a new instance of RepoClientFactory. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
The first argument is typically a *testing.T value.