Argo CD allows cross-site scripting on repositories page
This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. In ui/src/app/shared/components/urls.ts, the following code exists to parse the repository URL.