CLEANSTART-2026-TG02283: Actions which insert URLs into the content attribute of HTML meta tags are not escaped

Q: What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges, and required user interaction. Exploitation therefore depends on a user interacting with attacker-influenced content.

Q: What is the expected impact if exploitation succeeds?

The vector indicates low confidentiality and integrity impact, with no availability impact. It also indicates scope change, meaning the vulnerable component can affect another security authority.

Q: Does the advisory identify affected versions or a workaround?

No affected version range, fixed version, configuration condition, or mitigation workaround is provided in the supplied data.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-27142

Frequently Asked Questions

What does an attacker need to exploit this issue?

The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges, and required user interaction. Exploitation therefore depends on a user interacting with attacker-influenced content.

What is the expected impact if exploitation succeeds?

The vector indicates low confidentiality and integrity impact, with no availability impact. It also indicates scope change, meaning the vulnerable component can affect another security authority.

Does the advisory identify affected versions or a workaround?

No affected version range, fixed version, configuration condition, or mitigation workaround is provided in the supplied data.

CLEANSTART-2026-TG02283: Actions which insert URLs into the content attribute of HTML meta tags are not escaped

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Does the advisory identify affected versions or a workaround?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Does the advisory identify affected versions or a workaround?