Windmill Labs
Monthly
Cross-tenant DNS and TLS poisoning in Windmill versions prior to 1.703.2 allows authenticated low-privilege users to write to /etc/hosts, /etc/resolv.conf, and the system CA bundle from inside nsjail script sandboxes, persisting tampered state across every subsequent job on the same worker pod. Because poisoned entries survive between executions, attackers can hijack hostname resolution, perform transparent HTTPS man-in-the-middle, and steal WM_TOKEN JWTs to escalate to workspace-admin in other tenants. Publicly available exploit code exists per SSVC (poc), and CVSS 4.0 rates this 8.6 with high confidentiality and integrity impact.
JavaScript code injection in Windmill's NativeTS executor allows workspace administrators to achieve remote code execution by embedding malicious payloads in environment variable values. The vulnerability (CWE-94) stems from improper sanitization of single quotes when interpolating workspace environment variables into JavaScript string literals, enabling arbitrary code execution in all NativeTS scripts within the affected workspace. Windmill versions prior to 1.664.0 are affected. CVSS 7.3 reflects high confidentiality, integrity, and availability impact, though exploitation requires high privileges (workspace admin role). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in Windmill through version 1.783.0 expose job metrics and progress endpoints to any authenticated operator within a workspace, regardless of job ownership. The job_metrics API handlers omit authorization extractors entirely, meaning operators can silently monitor sensitive execution data for jobs they do not own and inject fabricated progress updates into foreign jobs. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-privilege entry bar makes it exploitable by any workspace operator.
Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.
Authenticated workspace members in Windmill through 1.783.0 can exfiltrate plaintext resource credentials stored in legacy ownerless draft scripts by querying the drafts API endpoint. The ACL enforcement logic fails to restrict access when a draft's owner email field is null, allowing any workspace member - regardless of their actual permissions - to retrieve these drafts and the secrets embedded within them. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make it a meaningful internal threat wherever legacy drafts containing credentials persist.
Cross-tenant DNS and TLS poisoning in Windmill versions prior to 1.703.2 allows authenticated low-privilege users to write to /etc/hosts, /etc/resolv.conf, and the system CA bundle from inside nsjail script sandboxes, persisting tampered state across every subsequent job on the same worker pod. Because poisoned entries survive between executions, attackers can hijack hostname resolution, perform transparent HTTPS man-in-the-middle, and steal WM_TOKEN JWTs to escalate to workspace-admin in other tenants. Publicly available exploit code exists per SSVC (poc), and CVSS 4.0 rates this 8.6 with high confidentiality and integrity impact.
JavaScript code injection in Windmill's NativeTS executor allows workspace administrators to achieve remote code execution by embedding malicious payloads in environment variable values. The vulnerability (CWE-94) stems from improper sanitization of single quotes when interpolating workspace environment variables into JavaScript string literals, enabling arbitrary code execution in all NativeTS scripts within the affected workspace. Windmill versions prior to 1.664.0 are affected. CVSS 7.3 reflects high confidentiality, integrity, and availability impact, though exploitation requires high privileges (workspace admin role). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) at time of analysis.
Missing authorization controls in Windmill through version 1.783.0 expose job metrics and progress endpoints to any authenticated operator within a workspace, regardless of job ownership. The job_metrics API handlers omit authorization extractors entirely, meaning operators can silently monitor sensitive execution data for jobs they do not own and inject fabricated progress updates into foreign jobs. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low-privilege entry bar makes it exploitable by any workspace operator.
Broken authorization on the update_resource_type endpoint in Windmill through 1.783.0 allows any authenticated workspace member to overwrite resource type schemas without administrator privileges. The delete_resource_type endpoint on the same platform correctly enforces an admin permission check, but the update counterpart omits it entirely, creating an inconsistent and exploitable trust boundary. No public exploit is identified at time of analysis and the vulnerability is absent from CISA KEV, but integrity of all resource type definitions - and the workflows depending on them - is at risk from any workspace member account.
Authenticated workspace members in Windmill through 1.783.0 can exfiltrate plaintext resource credentials stored in legacy ownerless draft scripts by querying the drafts API endpoint. The ACL enforcement logic fails to restrict access when a draft's owner email field is null, allowing any workspace member - regardless of their actual permissions - to retrieve these drafts and the secrets embedded within them. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make it a meaningful internal threat wherever legacy drafts containing credentials persist.