Workflow re-write vulnerability using input parameter

中危 6.5CVE-2021-37914 · BIT-argo-workflows-2021-37914 · GHSA-h563-xh25-x54q · Published 03/08/2021 · updated 17/06/2026

要点

CVE-2021-37914 是影响 github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2, github.com/argoproj/argo-workflows/v3 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.96%，高于 61.7% 的漏洞。
修复：升级到 3.1.6 或更高版本。

Package	Affected versions	Patched versions
github.com/argoproj/argo-workflows Go	`all versions`	No fix yet
github.com/argoproj/argo-workflows/v2 Go	`all versions`	No fix yet
github.com/argoproj/argo-workflows/v3 Go	`≥ 3.1.0, < 3.1.6`	`3.1.6`
argo workflows argoproj	`≤ 3.1.3`	No fix yet

Description

Impact

Allow end-users to set input parameters, but otherwise expect workflows to be secure.

Patches

Not yet.

Workarounds

Set EXPRESSION_TEMPLATES=false for the workflow controller

References

https://github.com/argoproj/argo-workflows/issues/6441

For more information

If you have any questions or comments about this advisory:

Open an issue in example link to repo
Email us at example email address

NVD description

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

References

argoproj/argo-workflows security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-37914 · ADVISORY
argoproj/argo-workflows · WEB
argoproj/argo-workflows#6285 · WEB
argoproj/argo-workflows#6442 · WEB
argoproj/argo-workflows commit 2a2ecc9 · WEB
github.com/argoproj/argo-workflows/v3 · PACKAGE

github.com/argoproj/argo-workflows 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/argoproj/argo-workflows

all versions

No fix yet

github.com/argoproj/argo-workflows/v2

all versions

No fix yet

github.com/argoproj/argo-workflows/v3

≥ 3.1.0, < 3.1.6

3.1.6

argo workflows

argoproj

≤ 3.1.3

No fix yet

Description

Impact

Allow end-users to set input parameters, but otherwise expect workflows to be secure.

Patches

Not yet.

Workarounds

Set EXPRESSION_TEMPLATES=false for the workflow controller

References

https://github.com/argoproj/argo-workflows/issues/6441

For more information

If you have any questions or comments about this advisory:

Open an issue in example link to repo
Email us at example email address

NVD description

github.com/argoproj/argo-workflows 的其他漏洞

查看全部 →