---
title: "Security digest: May 28, 2025"
url: https://erroneo.us/security/2025-05-28/
description: "May 28, 2025 vulnerability digest: 2 critical advisories (GitHub Actions, Go). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2025-05-28
date_modified: 2025-05-28
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: May 28, 2025

2 critical advisories.

## Take stock

- GitHub Actions: 1 critical advisory ( broadinstitute/cromwell ). Check with grep -rn 'uses: <owner>/<action>' .github/workflows .
- Go: 1 critical advisory ( github.com/argoproj/argo-cd , github.com/argoproj/argo-cd/v2 , github.com/argoproj/argo-cd/v3 ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-phf6-hm3h-x8qp](https://erroneo.us/security/ghsa/GHSA-phf6-hm3h-x8qp/index.md) Cromwell GitHub Actions Secrets exfiltration via `Issue_comment` — GitHub Actions broadinstitute/cromwell >= 87, < 90 → 90
- [CVE-2025-47933](https://erroneo.us/security/cve/CVE-2025-47933/index.md) Argo CD allows cross-site scripting on repositories page — Go github.com/argoproj/argo-cd >= 1.2.0-rc1, <= 1.8.7 → no fix; Go github.com/argoproj/argo-cd/v2 >= 2.0.0-rc3, < 2.13.8 → 2.13.8; Go github.com/argoproj/argo-cd/v2 >= 2.14.0-rc1, < 2.14.13 → 2.14.13

---
Source page: https://erroneo.us/security/2025-05-28/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt