Product
The @argos-ci/core package is vulnerable to OS command injection when processing unvalidated branch or reference names in environments where hasRemoteContentAccess is disabled, allowing arbitrary code execution on CI runners.