CVE-2025-66626
High · 8.1CVSS
8.1
EPSS
0.7%
Published
Dec 9, 2025
CISA due date
—
The record
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/argoproj/argo-workflows | 0 | No fix |
| Go | github.com/argoproj/argo-workflows/v2 | 0 | No fix |
| Go | github.com/argoproj/argo-workflows/v3 | 0 | 3.6.14 |
| Go | github.com/argoproj/argo-workflows/v3 | 0 | 3.6.12 |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.0 | 3.7.3 |
| Go | github.com/argoproj/argo-workflows/v3 | 3.7.0 | 3.7.5 |
| Bitnami | argo-workflows | 0 | 2.5.3 |
| Chainguard | argo-workflow-controller-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-controller-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.2-r0 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.2-r0 |
| Chainguard | kubeflow-pipelines | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-apiserver | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-cache_server | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r3 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r3 |
| Wolfi | argo-workflow-controller-4.0 | 0 | 4.0.2-r0 |
| Wolfi | argo-workflow-executor-4.0 | 0 | 4.0.2-r0 |
| Wolfi | argo-workflows-4.0 | 0 | 4.0.2-r0 |
| Wolfi | kubeflow-pipelines | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-apiserver | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-cache_server | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-persistence_agent | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 0 | 2.15.0-r3 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 0 | 2.15.0-r3 |
| go | github.com/argoproj/argo-workflows/v3 | 3.7.0 | 3.7.5 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
Related vulnerabilities
- CVE-2026-23960 Argo Workflows is an open source container-native workflow engine for orchestrating… Also affects github.com/argoproj/argo-workflows
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects argo-workflow-controller-4.0
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects argo-workflow-controller-4.0
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects argo-workflow-controller-4.0
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects argo-workflow-controller-4.0
- CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects argo-workflow-controller-4.0
- CVE-2026-34165 go-git is an extensible git implementation library written in pure Go. Also affects argo-workflow-executor-4.0
- CVE-2026-33762 go-git is an extensible git implementation library written in pure Go. Also affects argo-workflow-executor-4.0