CLEANSTART-2026-YT37124: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Q: Does exploitation require an authenticated account?

No. The CVSS vector indicates no privileges are required, although exploitation requires user interaction.

Q: Which deployments are most relevant to triage?

Deployments using the cleanstart/argo-workflows package and JavaScript template literals with template branches are the relevant exposure set. The provided data does not identify affected versions or whether any default configuration is affected.

Q: What is the assessed impact if exploitation succeeds?

The assessment indicates low confidentiality and integrity impact, with no availability impact. The CVSS vector also indicates scope change.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-32289

Frequently Asked Questions

Does exploitation require an authenticated account?

No. The CVSS vector indicates no privileges are required, although exploitation requires user interaction.

Which deployments are most relevant to triage?

Deployments using the cleanstart/argo-workflows package and JavaScript template literals with template branches are the relevant exposure set. The provided data does not identify affected versions or whether any default configuration is affected.

What is the assessed impact if exploitation succeeds?

The assessment indicates low confidentiality and integrity impact, with no availability impact. The CVSS vector also indicates scope change.

CLEANSTART-2026-YT37124: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require an authenticated account?

Which deployments are most relevant to triage?

What is the assessed impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated account?

Which deployments are most relevant to triage?

What is the assessed impact if exploitation succeeds?