Junglewise Threat Intelligence
CVE-2025-66626: GO-2025-4223 - RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
CVE-2025-66626 · Severity: low · CVSS 3.1 · Published 2025-12-15
Technologies: github.com/argoproj/argo-workflows/v3 (Go), github.com/argoproj/argo-workflows/v2 (Go), github.com/argoproj/argo-workflows (Go). Vendors: Go.
Executive brief
RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows
Affected products
- Go github.com/argoproj/argo-workflows/v3
- Go github.com/argoproj/argo-workflows/v2
- Go github.com/argoproj/argo-workflows