Digest · Wednesday
Security digest: May 28, 2025
2 critical advisories.
All digests · RSS · Markdown
Take stock
- GitHub Actions: 1 critical advisory (
broadinstitute/cromwell). Check withgrep -rn 'uses: <owner>/<action>' .github/workflows. - Go: 1 critical advisory (
github.com/argoproj/argo-cd,github.com/argoproj/argo-cd/v2,github.com/argoproj/argo-cd/v3). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
GitHub Actions 1
Check: grep -rn 'uses: <owner>/<action>' .github/workflows
- Cromwell GitHub Actions Secrets exfiltration via `Issue_comment` GHSA-phf6-hm3h-x8qp CVSS 9.1 Critical
broadinstitute/cromwell>= 87, < 90 → fixed in 90
Go 1
Check: govulncheck ./...
- Argo CD allows cross-site scripting on repositories page CVE-2025-47933 CVSS 9.0 Critical
github.com/argoproj/argo-cd>= 1.2.0-rc1, <= 1.8.7 → no fix listed;github.com/argoproj/argo-cd/v2>= 2.0.0-rc3, < 2.13.8 → fixed in 2.13.8;github.com/argoproj/argo-cd/v2>= 2.14.0-rc1, < 2.14.13 → fixed in 2.14.13; +1 more packages