CLEANSTART-2026-WH01870: Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Q: What does an attacker need to exploit this issue?

The issue is reachable remotely and requires no privileges or user interaction, according to the supplied CVSS vector. Exploitation would involve providing a URL whose host component contains bracketed content that is not an IPv6 address.

Q: What is the impact if exploitation succeeds?

The supplied severity data indicates low confidentiality impact, with no integrity or availability impact. The vector does not provide further detail about what information could be disclosed.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-47912

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is reachable remotely and requires no privileges or user interaction, according to the supplied CVSS vector. Exploitation would involve providing a URL whose host component contains bracketed content that is not an IPv6 address.

What is the impact if exploitation succeeds?

The supplied severity data indicates low confidentiality impact, with no integrity or availability impact. The vector does not provide further detail about what information could be disclosed.

CLEANSTART-2026-WH01870: Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?