CVE-2026-59960

@argos-ci/[email protected] is vulnerable to OS command injection (CWE-78): the CI branch/ref string, sourced unvalidated from the CI environment (e.g., GITHUB_HEAD_REF on GitHub Actions), is interpolated directly into an execSync() template literal in packages/core/src/ci-environment/git.ts, which executes it via /bin/sh -c so metacharacters like $() or backticks are evaluated as shell commands. The vulnerable path is reached when the Argos API reports hasRemoteContentAccess: false, causing the upload flow to call getMergeBaseCommitSha(), which passes the unsanitized branch name as the ref to gitFetch()'s `git fetch` command; a secondary sink exists in a `git merge-base` call. An attacker who can influence a project's branch name, for example by opening a pull request with a crafted branch name containing shell metacharacters, gains arbitrary OS command execution on the CI runner. Projects running @argos-ci/core 6.2.0 in CI where branch names can be attacker-controlled and remote content access is disabled are affected. There is no known public proof-of-concept, the issue is not in CISA KEV, and no in-the-wild exploitation is known.

What to do: Upgrade to a patched @argos-ci/core release when one becomes available; the recommended fix is to replace template-literal execSync() calls with execFileSync() using argument arrays so the shell is bypassed entirely. As interim mitigations, allowlist or sanitize the CI branch name (e.g., reject shell metacharacters in GITHUB_HEAD_REF) or ensure the Argos project has remote content access so the getMergeBaseCommitSha() path is not taken. Review CI runner logs and stored secrets for signs of command execution triggered by attacker-crafted pull-request branch names.