HIGH 7.5 GitHub
CVE-2026-59960
@argos-ci/core: CI Branch Name OS Command Injection
## CI Branch Name OS Command Injection in @argos-ci/core
### Summary
`@argos-ci/core@6.2.0` passes attacker-controlled CI branch/ref strings directly into an `execSync()` template literal in `packages/core/src/ci-environment/git.ts:89`. When a CI project has `hasRemoteContentAccess: false`, the Argos upload flow calls `getMergeBaseCommitSha()`, which invokes `gitFetch()` with the unsanitized branch name. Because `execSync()` passes the command string to `/bin/sh -c`, shell metacharacters such
Affected Products
- npm/@argos-ci/core <= 6.2.0
References
- https://github.com/advisories/GHSA-4x45-gxvp-6283
- https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283
- https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf6727
- https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/core@6.2.1
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-10 via GitHub. Affected: npm/@argos-ci/core <= 6.2.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.