CVE-2026-73084

Received Received - Intake

DOM-Based XSS in Activepieces Workflow Automation

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-08-31

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73084

EUVD

EUVD-2026-56552

Affected Vendors & Products

Vendor	Product	Version / Range
activepieces	activepieces	to 0.83.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in Activepieces versions prior to 0.83.0. The /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. This allows an attacker to inject malicious JavaScript code that executes in the Activepieces origin when a logged-in user opens a crafted URL.

Detection Guidance

Check Activepieces versions prior to 0.83.0. Inspect network traffic for requests to /api/redirect with user-supplied code parameters. Look for inline script blocks containing unescaped code values in responses.

Impact Analysis

An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. The victim must be tricked into opening a malicious URL for the attack to succeed. The vulnerability has a CVSS score of 6.1 (Moderate).

Compliance Impact

This vulnerability could lead to unauthorized access to user data, including session tokens and API interactions, potentially violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. The reflected XSS flaw allows attackers to execute malicious scripts in the victim's browser, enabling data theft or unauthorized actions that may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Activepieces to version 0.83.0 or later. If upgrading is not immediately possible, block the /api/redirect endpoint at the reverse proxy if OAuth is not in use. Implement strict input validation for all query parameters.

Hi! I’m here to help you understand CVE-2026-73084. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70