CLEANSTART-2026-NH24608: NPM package `braces`, versions prior to 3

Q: What access does an attacker need to exploit this issue?

The available severity vector indicates that exploitation is network-accessible, requires no privileges, no user interaction, and has low attack complexity.

Q: What is the expected impact if exploitation succeeds?

The severity vector indicates an availability impact rated high, with no indicated confidentiality or integrity impact.

Q: Which dependency versions are affected?

The affected dependency is the NPM package braces in versions earlier than 3. The provided data does not identify the affected argo-workflows versions or the dependency path.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The NPM package braces, versions prior to 3.

Affected Software

2 affected componentsFixes available

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1
Upgrade
Upgrade npm/braces to a version that resolves this vulnerability.
Fixed in 3

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-4068

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The available severity vector indicates that exploitation is network-accessible, requires no privileges, no user interaction, and has low attack complexity.

What is the expected impact if exploitation succeeds?

The severity vector indicates an availability impact rated high, with no indicated confidentiality or integrity impact.

Which dependency versions are affected?

The affected dependency is the NPM package braces in versions earlier than 3. The provided data does not identify the affected argo-workflows versions or the dependency path.

CLEANSTART-2026-NH24608: NPM package `braces`, versions prior to 3

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which dependency versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which dependency versions are affected?