Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59960 · Microsoft / collected KEV context

EUVD-2026-77641

GHSA-4x45-gxvp-6283

cve-program · CVE-2026-59960

• https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283
• https://github.com/argos-ci/argos-javascript/pull/319
• https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717
• https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/[email protected]

euvd · EUVD-2026-77641

• https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283
• https://github.com/argos-ci/argos-javascript/pull/319
• https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717
• https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/[email protected]

nvd · CVE-2026-59960

• https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717
• https://github.com/argos-ci/argos-javascript/pull/319
• https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/[email protected]
• https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283

osv · GHSA-4x45-gxvp-6283

• https://github.com/argos-ci/argos-javascript/security/advisories/GHSA-4x45-gxvp-6283
• https://github.com/argos-ci/argos-javascript/commit/8355f3af3be3f4fe361d58a688d21535cf672717
• https://github.com/argos-ci/argos-javascript
• https://github.com/argos-ci/argos-javascript/releases/tag/@argos-ci/[email protected]

No related operational record is retained in the current change model.