@argos-ci/core: CI Branch Name OS Command Injection

Published September 10, 2026 CVE-2026-59960

@argos-ci/core can let an attacker run commands on a CI build machine through a malicious branch name. The risk applies when Argos processes that branch during certain CI uploads.

Severity
HighCVSS 7.5
Fix
Fixed in 6.2.1Fix recorded today
Affected versions
6.2.0 or older
Affects
@argos-ci/core

How it works

  • Argos reads a branch name supplied by the CI environment.
  • In affected releases, it inserts that name into a system command without separating it safely.
  • A crafted branch name can then make the CI runner execute attacker-controlled commands when Argos calculates Git history.
  • This requires the project setting hasRemoteContentAccess: false.

What to do

Run npm list @argos-ci/core in the project using Argos. Compare the installed version with the advisory; versions 6.2.0 and earlier are affected.

Run this in the application environment you want to check:

npm list @argos-ci/core

Update @argos-ci/core to version 6.2.1 or later. The Argos release notes identify 6.2.1 as fixing command injection through CI branch names.

Technical details

The flaw occurs when branch or ref values reach shell-interpreting execSync calls in Argos Git helpers. The fix replaces those calls with execFileSync argument arrays, so Git runs without a shell interpreting branch-name characters.

References

View Original Source