CLEANSTART-2026-NX24954: If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Q: Who is realistically exposed to this issue?

Deployments using the cleanstart/argo-workflows package are exposed when a trusted template author creates a script tag with an empty type attribute or a type attribute containing ASCII whitespace, and data is passed into that script block.

Q: What does an attacker need to exploit the vulnerability?

The issue requires a vulnerable template to be present and data passed into its affected script block. The supplied severity vector indicates network reachability, no privileges required, low attack complexity, and user interaction is required.

Q: Are default configurations affected?

The available information does not establish whether default configurations include templates with the affected script-tag type attribute conditions. Exposure depends on the contents of trusted templates.

Q: How can I assess whether my templates are affected?

Review trusted templates for script tags whose type attribute is empty or contains ASCII whitespace. Identify whether untrusted or attacker-influenced data is inserted into those script blocks, because that data may be incorrectly escaped.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-39826

Frequently Asked Questions

Who is realistically exposed to this issue?

Deployments using the cleanstart/argo-workflows package are exposed when a trusted template author creates a script tag with an empty type attribute or a type attribute containing ASCII whitespace, and data is passed into that script block.

What does an attacker need to exploit the vulnerability?

The issue requires a vulnerable template to be present and data passed into its affected script block. The supplied severity vector indicates network reachability, no privileges required, low attack complexity, and user interaction is required.

Are default configurations affected?

The available information does not establish whether default configurations include templates with the affected script-tag type attribute conditions. Exposure depends on the contents of trusted templates.

How can I assess whether my templates are affected?

Review trusted templates for script tags whose type attribute is empty or contains ASCII whitespace. Identify whether untrusted or attacker-influenced data is inserted into those script blocks, because that data may be incorrectly escaped.

CLEANSTART-2026-NX24954: If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are default configurations affected?

How can I assess whether my templates are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Are default configurations affected?

How can I assess whether my templates are affected?