Snyk test report

Improper Authentication

critical severity

Exploit: Not Defined

Manifest file: quay.io/argoproj/argocd:latest › /usr/local/bin/git-lfs
Package Manager: golang
Vulnerable module: golang.org/x/net/idna
Introduced through: go-distribution@command-line-arguments@* and golang.org/x/net/idna@v0.38.0

Detailed paths

Introduced through: go-distribution@command-line-arguments@* › golang.org/x/net/idna@v0.38.0

Overview

Affected versions of this package are vulnerable to Improper Authentication via the ToASCII and ToUnicode functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.

Note: The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.

Remediation

Upgrade golang.org/x/net/idna to version 0.54.0 or higher.

Improper Authentication

Detailed paths

Overview

Remediation

References

Infinite loop

Detailed paths

Overview

Remediation

References

GPL-3.0 license

Detailed paths

Time-of-check Time-of-use (TOCTOU)

Detailed paths

NVD Description

Remediation

References

Authentication Bypass

Detailed paths

NVD Description

Remediation

References

Directory Traversal

Detailed paths

NVD Description

Remediation

References

CVE-2026-35350

Detailed paths

NVD Description

Remediation

References

CVE-2026-35357

Detailed paths

NVD Description

Remediation

References

CVE-2026-35374

Detailed paths

NVD Description

Remediation

References

CVE-2026-35373

Detailed paths

NVD Description

Remediation

References

CVE-2026-35370

Detailed paths

NVD Description

Remediation

References

CVE-2026-35341

Detailed paths

NVD Description

Remediation

References

CVE-2026-35367

Detailed paths

NVD Description

Remediation

References

CVE-2026-35368

Detailed paths

NVD Description

Remediation

References

CVE-2026-35354

Detailed paths

NVD Description

Remediation

References

CVE-2026-35348

Detailed paths

NVD Description

Remediation

References

CVE-2026-35371

Detailed paths

NVD Description