CVE-2021-37914 Workflow re-write vulnerability using input parameter

What is CVE-2021-37914?

CVE-2021-37914 is a medium-severity code injection vulnerability in n/a, published on 2 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running workflows, an attacker may be able to disrupt a workflow because expression template output is evaluated.

Weakness: CWE-20

Which versions are affected by CVE-2021-37914?

6 open source packages ship an affected version, including github.com/argoproj/argo-workflows/v3, argo-workflows and github.com/argoproj/argo-workflows. It affects 1 product.

Products include Argoproj Argo Workflows.

How do I fix CVE-2021-37914?

Upgrade github.com/argoproj/argo-workflows/v3 to 3.1.6 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-37914 being exploited?

There is no known exploitation of CVE-2021-37914 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template Critical 9.8
• CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing High 8.9
• CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode High 8.9
• CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials High 8.5
• CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-workflows-2021-37914, GHSA-h563-xh25-x54q, GO-2022-0928.