CVE-2022-38790: Weave.works Gitops

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.

Affected products

• Weave.works Gitops: before 0.9.0 (fixed in 0.9.0); version 0.9.0 only

Published 2022-09-01. Last modified 2026-06-17.