GCVE - cpe:2.3:a:argo_events_project:argo_events:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:argo_events_project:argo_events:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Argo Events Project (`e82ad0f5-e565-520d-afb5-cba1423911d9`)
Product	Argo Events (`22c614c1-91ac-52dc-8a7c-80c5be25c6a5`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/argoproj/argo-events`	purl2cpe	2026-06-01 10:11:58.317855
`pkg:rpm/opensuse/argo-events`	purl2cpe	2026-06-01 10:11:58.317858

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-31054`	vulnerable	2026-06-08 05:43:40.075411	Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events HIGH (7.5) Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1. Published: 2022-06-13T19:40:12.000Z Updated: 2025-04-23T18:16:35.943Z Open on db.gcve.eu Reference links https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 https://github.com/argoproj/argo-events/issues/1946 https://github.com/argoproj/argo-events/pull/1966 https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25856`	vulnerable	2026-06-08 05:41:49.573307	Directory Traversal HIGH (7.5) The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ... Published: 2022-06-17T20:00:17.630Z Updated: 2024-09-17T04:24:21.034Z Open on db.gcve.eu Reference links https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961 https://github.com/argoproj/argo-events/issues/1947	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.