{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-121621","cwes":["CWE-78"],"description":"A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793739653423,"publishedAt":1793739653423,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-121621"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565914"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/argoproj-labs/argocd-image-updater/pull/1905"}],"remediation":[],"revision":"f6634675efa70a24a22faa2e42e2b4c51a97dd484415e773c16eba7648217b2a","sources":[{"modifiedAt":1793739653423,"name":"CNA: redhat","retrievedAt":1793740847224,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121621"}],"ssvc":null,"status":"published","title":"Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration","updatedAt":1793740847224}