Executive brief
Argos CI is a visual testing platform used in automated CI/CD pipelines to detect visual regressions. The core library passes unsanitized branch names from pull requests directly into shell commands, allowing attackers who can control branch names to execute arbitrary OS commands on CI runners with full access to repository secrets, build artifacts, and deployment credentials.
Technical details
This is an OS Command Injection vulnerability (CWE-78) in the git.ts module. The vulnerable code passes user-supplied branch names directly into execSync() template literals in two locations: gitFetch() at line 87-90 and gitMergeBase() at line 67. Since execSync() invokes /bin/sh -c with the string, shell metacharacters like $() command substitution are evaluated before the git command executes. The attack chain begins when env.GITHUB_HEAD_REF is read without validation, flows through config.ts (which applies only String formatting, no sanitization), and reaches the sink in upload.ts:285 when getMergeBaseCommitSha() is called for projects with hasRemoteContentAccess: false (the default). The precondition is that an attacker must be able to influence the branch name (e.g., via a pull request), which is possible in pull_request_target workflows. A fix is available in version 6.2.1 using execFileSync() with argument arrays to bypass shell interpretation.
Affected products
- Argos CI @argos-ci/core <= 6.2.0
- Argos CI @argos-ci/cli <= 5.1.0
Timeline
- 2026-06-21: disclosed: Published in GitHub Advisory Database
- 2026-09-10: advisory: GHSA-4x45-gxvp-6283 updated with full advisory details
- 2026-06-21: patched: @argos-ci/core 6.2.1 released with fix using execFileSync()