{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aargoprojargo_cd_image_updater/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:argoproj:argo_cd_image_updater:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-121621"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-121621\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Argo CD Image Updater"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Argoproj"],"content_html":"\u003cp\u003eCVE-2026-121621 is a command injection vulnerability in Argo CD Image Updater. The vulnerability exists because proxy URLs configured for SSH-based Git repositories are passed to shell-interpreted SSH commands without adequate sanitization. An attacker with the ability to modify the proxy configuration can inject shell metacharacters to execute arbitrary commands with the privileges of the Image Updater process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the Argo CD Image Updater process. This provides the attacker the ability to access service credentials stored by the Image Updater, potentially leading to broader compromise of the Argo CD environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Argo CD Image Updater to a version containing the patch for CVE-2026-121621 as soon as released.\u003c/li\u003e\n\u003cli\u003eAudit existing Argo CD Image Updater configurations for any suspicious proxy settings, particularly those utilizing shell metacharacters (e.g., ;, |, \u0026amp;, $, etc.).\u003c/li\u003e\n\u003cli\u003eRestrict access to the configuration interfaces of Argo CD Image Updater to prevent unauthorized modification of repository proxy settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T00:46:47Z","date_published":"2026-11-03T22:18:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-argo-cd-image-updater-rce/","summary":"Argo CD Image Updater fails to sanitize proxy URL inputs for SSH Git repositories, allowing attackers to perform command injection and execute arbitrary code within the service process.","title":"Argo CD Image Updater: Command Injection in SSH Proxy URL (CVE-2026-121621)","url":"https://feed.craftedsignal.io/briefs/2026-11-argo-cd-image-updater-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:argoproj:argo_cd_image_updater:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}