CVE-2026-59960.

Disclosure summary

## CI Branch Name OS Command Injection in @argos-ci/core ### Summary `@argos-ci/core@6.2.0` passes attacker-controlled CI branch/ref strings directly into an `execSync()` template literal in `packages/core/src/ci-environment/git.ts:89`. When a CI project has `hasRemoteContentAccess: false`, the Argos upload flow calls `getMergeBaseCommitSha()`, which invokes `gitFetch()` with the unsanitized branch name. Because `execSync()` passes the command string to `/bin/sh -c`, shell metacharacters such as `$()` command substitution are evaluated before `git` runs, enabling an attacker who can influence the branch name (e.g., via a pull request) to execute arbitrary OS commands on the CI runner. CVSS Base Score: 7.5 (High). ### Details The vulnerable sink is in `packages/core/src/ci-environment/git.ts:87-90`: ```ts function gitFetch(input: { ref: string; depth: number; target: string }) { execSync( `git fetch --force --update-head-ok --depth ${input.depth} origin ${input.ref}:${input.target}`, ); } ``` `execSync()` with a template-literal string invokes `/bin/sh -c ""`. The shell expands `$()`, backticks, `;`, and other metacharacters before spawning `git`, so any special characters present i

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-09-10T18:34:17-04:00
MODIFIED 2026-10-01T04:56:26-04:00
INGESTED 2026-10-06T11:45:02-04:00