CVE-2026-59960: Argos JavaScript SDK RCE Vulnerability

CVE-2026-59960 Overview

CVE-2026-59960 is an OS command injection vulnerability [CWE-78] in the Argos JavaScript SDK, affecting the @argos-ci/core package prior to version 6.2.1. Attacker-controlled values from GITHUB_HEAD_REF or ARGOS_BRANCH environment variables flow into execSync() calls executed by /bin/sh -c. A pull request branch name containing shell metacharacters can execute arbitrary commands on the CI runner with the Argos upload process privileges.

Critical Impact

Successful exploitation can expose CI secrets, alter build artifacts, or fully compromise the CI runner via a maliciously named pull request branch.

Affected Products

• Argos JavaScript SDK @argos-ci/core package versions prior to 6.2.1
• CI environments using GITHUB_HEAD_REF (GitHub Actions) with Argos uploads
• CI environments using the ARGOS_BRANCH environment variable

Discovery Timeline

• 2026-09-14 - CVE-2026-59960 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-59960

Vulnerability Analysis

The vulnerability resides in packages/core/src/ci-environment/git.ts within the gitFetch() and gitMergeBase() functions. Both functions build shell commands by interpolating branch or ref values directly into command strings passed to execSync(). Node.js executes execSync() command strings through /bin/sh -c, which parses shell metacharacters such as ;, |, &, $(), and backticks.

The unsanitized data flows from config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. This condition is common for pull requests from forks, where the CI environment cannot reach private remote content and falls back to local git operations. An attacker who can open a pull request can name the source branch to include shell payloads that execute during the Argos upload step.

Root Cause

The root cause is unsafe use of execSync() with string concatenation of untrusted input. Environment variables such as GITHUB_HEAD_REF are attacker-controlled in fork-based pull request workflows. Git itself permits a wide range of characters in ref names, so shell metacharacters can survive into the command string and be interpreted by the shell.

Attack Vector

An attacker forks a repository that uses Argos in its CI pipeline. They create a branch whose name contains a shell command substitution payload, then open a pull request. When the CI job runs the Argos upload step, gitFetch() or gitMergeBase() interpolates the branch name into a shell command, causing the payload to execute with the runner's privileges. The attacker can then exfiltrate secrets stored in the CI environment or tamper with build artifacts.

// Patch from packages/core/src/ci-environment/git.ts
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { debug, isDebugEnabled } from "../debug";

/**
 * The fix introduces execFileSync, which passes arguments as an array
 * rather than a single shell-parsed string, preventing metacharacter
 * interpretation by /bin/sh -c.
 */

Source: GitHub Commit 8355f3a

Detection Methods for CVE-2026-59960

Indicators of Compromise

• CI job logs containing pull request branch names with shell metacharacters such as ;, |, &, $(, or backticks
• Unexpected outbound network connections from CI runners during Argos upload steps
• Unexpected child processes spawned by the Node.js process running @argos-ci/core
• Access or exfiltration events involving CI secrets shortly after an Argos upload step

Detection Strategies

• Inspect webhook and pull request event payloads for branch or ref names containing shell metacharacters
• Audit CI job logs for git fetch or git merge-base commands with anomalous arguments
• Monitor for unexpected process trees originating from Node.js processes on CI runners
• Compare installed @argos-ci/core package versions across repositories against the fixed release 6.2.1

Monitoring Recommendations

• Enable command-line auditing on CI runners and forward logs to a centralized analytics platform
• Alert on network egress from CI runners to unknown destinations during build steps
• Track secret access patterns from CI environments and flag deviations from baseline
• Monitor package manifests in pull requests for downgrades of @argos-ci/core below 6.2.1

How to Mitigate CVE-2026-59960

Immediate Actions Required

• Upgrade @argos-ci/core to version 6.2.1 or later in all projects that consume Argos
• Rotate any CI secrets that may have been exposed on runners executing untrusted pull requests
• Review CI job history for pull requests with unusual branch names during the vulnerable window
• Restrict fork pull request workflows from accessing sensitive secrets until patched

Patch Information

The fix is available in @argos-ci/core version 6.2.1. The patch replaces string-interpolated execSync() calls with execFileSync(), passing arguments as an array so that the shell does not parse them. Full patch details are available in the GitHub Security Advisory GHSA-4x45-gxvp-6283 and the release notes for @argos-ci/core 6.2.1.

Workarounds

• Pin CI workflows to run Argos uploads only on trusted branches, not on fork pull requests
• Use GitHub Actions pull_request (not pull_request_target) to avoid exposing repository secrets to fork PRs
• Validate GITHUB_HEAD_REF and ARGOS_BRANCH values against an allowlist regex before invoking Argos
• Scope CI runner permissions to the minimum required for the Argos upload step

# Upgrade to the patched version
npm install @argos-ci/core@^6.2.1

# Or with pnpm / yarn
pnpm add @argos-ci/core@^6.2.1
yarn add @argos-ci/core@^6.2.1

# Verify the installed version
npm ls @argos-ci/core