Kustomize --helm-command Flag Abuse via Argo CD Repo-Server (CVE-2024-31989)

Ethan Andrews@eandrews

•updated Jul 1, 2026•4•0•10

Detects the execution of 'kustomize' with the '--helm-command' flag configured to use a non-standard binary or script. When triggered within the context of an Argo CD repo-server, this behavior indicates a potential exploitation attempt of CVE-2024-31989, which allows for arbitrary command execution under the repo-server process context by coercing Kustomize to execute malicious files.