Windmill
Monthly
Cross-tenant DNS and TLS poisoning in Windmill versions prior to 1.703.2 allows authenticated low-privilege users to write to /etc/hosts, /etc/resolv.conf, and the system CA bundle from inside nsjail script sandboxes, persisting tampered state across every subsequent job on the same worker pod. Because poisoned entries survive between executions, attackers can hijack hostname resolution, perform transparent HTTPS man-in-the-middle, and steal WM_TOKEN JWTs to escalate to workspace-admin in other tenants. Publicly available exploit code exists per SSVC (poc), and CVSS 4.0 rates this 8.6 with high confidentiality and integrity impact.
Authorization bypass in Windmill 1.56.0-1.614.0 enables Operator role users to escalate privileges to remote code execution. Operators can bypass documented role restrictions via unprotected backend API endpoints to create/modify scripts, flows, and apps, then execute arbitrary code through the jobs API. Public exploit code exists (GitHub: Chocapikk/Windfall). EPSS data unavailable, but the low attack complexity (AC:L), network access vector (AV:N), and availability of weaponized POC indicate elevated real-world risk for self-hosted Windmill deployments with Operator-level users.
JavaScript code injection in Windmill's NativeTS executor allows workspace administrators to achieve remote code execution by embedding malicious payloads in environment variable values. The vulnerability (CWE-94) stems from improper sanitization of single quotes when interpolating workspace environment variables into JavaScript string literals, enabling arbitrary code execution in all NativeTS scripts within the affected workspace. Windmill versions prior to 1.664.0 are affected. CVSS 7.3 reflects high confidentiality, integrity, and availability impact, though exploitation requires high privileges (workspace admin role). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in Windmill through version 1.783.0 expose job metrics and progress endpoints to any authenticated operator within a workspace, regardless of job ownership. The job_metrics API handlers omit authorization extractors entirely, meaning operators can silently monitor sensitive execution data for jobs they do not own and inject fabricated progress updates into foreign jobs. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-privilege entry bar makes it exploitable by any workspace operator.
Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.
Authenticated workspace members in Windmill through 1.783.0 can exfiltrate plaintext resource credentials stored in legacy ownerless draft scripts by querying the drafts API endpoint. The ACL enforcement logic fails to restrict access when a draft's owner email field is null, allowing any workspace member - regardless of their actual permissions - to retrieve these drafts and the secrets embedded within them. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make it a meaningful internal threat wherever legacy drafts containing credentials persist.
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})".
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. [CVSS 2.7 LOW]
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-tenant DNS and TLS poisoning in Windmill versions prior to 1.703.2 allows authenticated low-privilege users to write to /etc/hosts, /etc/resolv.conf, and the system CA bundle from inside nsjail script sandboxes, persisting tampered state across every subsequent job on the same worker pod. Because poisoned entries survive between executions, attackers can hijack hostname resolution, perform transparent HTTPS man-in-the-middle, and steal WM_TOKEN JWTs to escalate to workspace-admin in other tenants. Publicly available exploit code exists per SSVC (poc), and CVSS 4.0 rates this 8.6 with high confidentiality and integrity impact.
Authorization bypass in Windmill 1.56.0-1.614.0 enables Operator role users to escalate privileges to remote code execution. Operators can bypass documented role restrictions via unprotected backend API endpoints to create/modify scripts, flows, and apps, then execute arbitrary code through the jobs API. Public exploit code exists (GitHub: Chocapikk/Windfall). EPSS data unavailable, but the low attack complexity (AC:L), network access vector (AV:N), and availability of weaponized POC indicate elevated real-world risk for self-hosted Windmill deployments with Operator-level users.
JavaScript code injection in Windmill's NativeTS executor allows workspace administrators to achieve remote code execution by embedding malicious payloads in environment variable values. The vulnerability (CWE-94) stems from improper sanitization of single quotes when interpolating workspace environment variables into JavaScript string literals, enabling arbitrary code execution in all NativeTS scripts within the affected workspace. Windmill versions prior to 1.664.0 are affected. CVSS 7.3 reflects high confidentiality, integrity, and availability impact, though exploitation requires high privileges (workspace admin role). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in Windmill through version 1.783.0 expose job metrics and progress endpoints to any authenticated operator within a workspace, regardless of job ownership. The job_metrics API handlers omit authorization extractors entirely, meaning operators can silently monitor sensitive execution data for jobs they do not own and inject fabricated progress updates into foreign jobs. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-privilege entry bar makes it exploitable by any workspace operator.
Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.
Authenticated workspace members in Windmill through 1.783.0 can exfiltrate plaintext resource credentials stored in legacy ownerless draft scripts by querying the drafts API endpoint. The ACL enforcement logic fails to restrict access when a draft's owner email field is null, allowing any workspace member - regardless of their actual permissions - to retrieve these drafts and the secrets embedded within them. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make it a meaningful internal threat wherever legacy drafts containing credentials persist.
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})".
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. [CVSS 2.7 LOW]
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.