https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T09:51:58.211254+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33881 CVE-2026-33881 — Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS… 2026-10-10T09:51:58.227770+00:00

Affected: windmill-labs windmill

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing `'` can inject arbitrary JavaScript that executes inside every NativeTS script in that workspace. This is a code injection bug in `worker.rs`, not related to the sandbox/NSJAIL topic. Version 1.664.0 patches the issue.