{"id":"CVE-2021-37914","details":"In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.","aliases":["BIT-argo-workflows-2021-37914","GHSA-h563-xh25-x54q","GO-2022-0928"],"modified":"2026-07-09T05:44:43.483378Z","published":"2021-08-03T00:15:08.607Z","references":[{"type":"REPORT","url":"https://github.com/argoproj/argo-workflows/issues/6441"},{"type":"FIX","url":"https://github.com/argoproj/argo-workflows/pull/6442"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/argoproj/argo-workflows","events":[{"introduced":"0"},{"last_affected":"9337abb002d3c505ca45c5fd2e25447acd80a108"}],"database_specific":{"cpe":"cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.1.3"}],"source":"CPE_RANGE"}}],"versions":["v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.1.0-rc14","v3.1.0-rc13","v3.1.0-rc12","v3.1.0-rc11","v3.1.0-rc10","v3.1.0-rc9","v3.1.0-rc8","v3.1.0-rc7","v3.1.0-rc6","v3.1.0-rc5","v3.1.0-rc4","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","ui-v3-rc1","v2.10.0-rc1","v2.3.0-rc3","v2.3.0-rc2","v2.3.0-rc1","v2.2.1","v2.1.1","v2.2.0","v2.1.0","v2.1.0-beta2","v2.1.0-beta1","v2.1.0-alpha1","v2.0.0","v2.0.0-beta1","v2.0.0-alpha3","v2.0.0-alpha2","v2.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37914.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}