# Snyk test report

June 9th 2024, 12:17:05 am (UTC+00:00)

Scanned the following paths:

- /argo-cd/argoproj/argo-cd/v2/go.mod (gomodules)
- /argo-cd/ui/yarn.lock (yarn)

7 known vulnerabilities
25 vulnerable dependency paths
2059 dependencies

## LGPL-3.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: gopkg.in/retry.v1
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/Azure/kubelogin/pkg/token@0.0.20 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/Azure/kubelogin/pkg/token@0.0.20 › gopkg.in/retry.v1@1.0.3

LGPL-3.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/r3labs/diff
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/r3labs/diff@1.1.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/r3labs/diff@1.1.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-version
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, code.gitea.io/sdk/gitea@0.18.0 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › code.gitea.io/sdk/gitea@0.18.0 › github.com/hashicorp/go-version@1.6.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/hashicorp/go-retryablehttp@0.7.4

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0, github.com/hashicorp/go-retryablehttp@0.7.4 and others

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/xanzy/go-gitlab@0.91.1 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/cmd@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/api@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/argoproj/notifications-engine/pkg/controller@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/subscriptions@#f48567108f01 › github.com/argoproj/notifications-engine/pkg/services@#f48567108f01 › github.com/opsgenie/opsgenie-go-sdk-v2/client@1.0.5 › github.com/hashicorp/go-retryablehttp@0.7.4 › github.com/hashicorp/go-cleanhttp@0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: /argo-cd/argoproj/argo-cd/v2 › go.mod
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 and github.com/gosimple/slug@1.13.1

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v2@0.0.0 › github.com/gosimple/slug@1.13.1

MPL-2.0 license

More about this vulnerability

## Template Injection

medium severity

- Manifest file: /argo-cd › ui/yarn.lock
- Package Manager: npm
- Vulnerable module: dompurify
- Introduced through: argo-cd-ui@1.0.0, redoc@2.0.0-rc.64 and others

### Detailed paths

- Introduced through: argo-cd-ui@1.0.0 › redoc@2.0.0-rc.64 › dompurify@2.3.6

## Overview

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Template Injection in `purify.js`, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML `CDATA` blocks.

## PoC

    <![CDATA[ ><img src onerror=alert(1)> ]]>

## Remediation

Upgrade `dompurify` to version 2.4.9, 3.0.11 or higher.

## References

- GitHub Commit
- GitHub Commit
- Vulnerability Report

More about this vulnerability