Argo CD allows a Kustomize-based Helm build to reference a Helm configuration directory that resides under repository control. When the operator enables the --enable-helm flag, Helm automatically loads a downloader plugin from the <configHome>/.data/plugins directory. The plugin is executed inside the argocd-repo-server process, which runs as the repo-server user. This flaw enables an attacker to execute arbitrary code with the privileges of the repo-server, including reading repository credentials and other data. The weakness is a classic case of arbitrary code execution in a trusted environment (CWE-829).

The vulnerability affects Argo CD versions from 2.1.0 up to and including 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 when the operator has enabled --enable-helm for kustomize builds. Deployments that have not enabled this flag or use earlier versions are not impacted. The issue is specific to builds that pass helmGlobals.configHome through to Helm, a behavior introduced in kustomize 4.1.0.

The CVSS score of 9.9 signifies critical severity. The EPSS score is unavailable, but the lack of a KEV listing does not reduce the risk; the exploitation vector remains high because the attacker can commit malicious files via a Git repository or POST /api/v1/applications/manifestsWithFiles, requiring only Application get permission on an existing Application. Once the attacker’s files are present, the plugin runs automatically during the Helm build, giving the attacker remote command execution as the repo-server user without needing repository write access. This makes the vulnerability highly exploitable in environments that rely on kustomize and Helm within Argo CD and have the --enable-helm flag turned on.