CVE-2026-121621
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 03, 2026
Vendor
unknown
Description
A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.