seclog: [HIGH] Multiple Critical Dependencies with Known Vulnerabilities Detected #5336
Description
Summary
Trivy scan found 5 HIGH severity CVEs in our dependencies. Argo Workflows v3.3.5 has a zip slip bug and leaks credentials. path-to-regexp 1.8.0 has a ReDoS issue that can crash the web app.
Details
Found these while running security scans:
Argo Workflows (v3.3.5 → need v3.6.12+)
- CVE-2025-62156: Zip slip vulnerability - attacker can write files outside intended directories
- CVE-2025-62157: Credentials get exposed in some scenarios
Affected files:
chaoscenter/graphql/server/go.modchaoscenter/subscriber/go.mod
path-to-regexp (1.8.0 → need 1.9.0+)
- CVE-2024-45296: ReDoS bug - malicious URLs can hang the app
Affected:
chaoscenter/web/yarn.lock
PoC
Run trivy to see it yourself:
trivy fs . --severity HIGH,CRITICAL
You'll see 2 vulns in graphql/server, 2 in subscriber, and 1 in web.
Impact
- Zip slip = potential RCE or file system tampering
- Credential leak = unauthorized access to artifact repos
- ReDoS = web app can be DoS'd with crafted requests
All production deployments are affected.
Remediation
Quick fix - just bump the versions:
Fix argo workflows
cd chaoscenter/graphql/server
go get github.com/argoproj/argo-workflows/[email protected]
go mod tidy
cd ../../../chaoscenter/subscriber
go get github.com/argoproj/argo-workflows/[email protected]
go mod tidy
Fix path-to-regexp
cd ../web
yarn upgrade path-to-regexp@^1.9.0
Verify with trivy fs . --severity HIGH,CRITICAL afterwards.