CLEANSTART-2026-DH06556: Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity. It does not require prior privileges or user interaction.

Q: What security impact is indicated by the available scoring data?

The scoring data indicates a high availability impact. It indicates no confidentiality or integrity impact.

Q: Which software is identified as affected?

The affected software is identified as cleanstart/argo-workflows, specifically the argo-workflows package. No affected or fixed version information is provided.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-34043

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with low attack complexity. It does not require prior privileges or user interaction.

What security impact is indicated by the available scoring data?

The scoring data indicates a high availability impact. It indicates no confidentiality or integrity impact.

Which software is identified as affected?

The affected software is identified as cleanstart/argo-workflows, specifically the argo-workflows package. No affected or fixed version information is provided.

CLEANSTART-2026-DH06556: Serialize JavaScript to a superset of JSON that includes regular expressions and functions

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact is indicated by the available scoring data?

Which software is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What security impact is indicated by the available scoring data?

Which software is identified as affected?