CLEANSTART-2026-HL65721: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Q: Does exploitation require an authenticated account or user interaction?

No privileges are required, but exploitation requires user interaction. The attack vector is network-based with low attack complexity.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is rated medium severity (6.1). It may result in low-impact confidentiality and integrity effects, with no availability impact; the scoring vector indicates scope change.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-39823

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

No privileges are required, but exploitation requires user interaction. The attack vector is network-based with low attack complexity.

What is the potential impact if exploitation succeeds?

The vulnerability is rated medium severity (6.1). It may result in low-impact confidentiality and integrity effects, with no availability impact; the scoring vector indicates scope change.

CLEANSTART-2026-HL65721: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account or user interaction?

What is the potential impact if exploitation succeeds?