CVE-2026-73083
Received Received - Intake

Code Execution in Activepieces Prior to 0.80.0

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('child_process'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-73083
EUVD
EUVD-2026-56551

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
activepieces activepieces to 0.80.0 (exc)
activepieces activepieces 0.80.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Activepieces allows authenticated users to bypass the V8 Isolate sandbox by executing user-provided code outside the sandbox before it is serialized into the V8 Isolate. This is due to the use of importFresh() in SANDBOX_CODE_ONLY mode, which enables access to Node.js APIs like child_process and fs.

Detection Guidance

Check ActivePieces version with 'npm list activepieces' or 'docker inspect <container> | grep ActivePieces'. If version is below 0.80.0 and SANDBOX_CODE_ONLY mode is enabled, the system is vulnerable. Review logs for unauthorized access attempts or unusual module loading patterns.

Impact Analysis

An attacker with access to create a Code step can read environment secrets such as AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This could lead to unauthorized data access, modification, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade ActivePieces to version 0.80.0 or later immediately. Disable SANDBOX_CODE_ONLY mode and switch to SANDBOX_CODE_AND_PROCESS mode for isolation. Rotate all secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73083. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart