CVE-2026-33881 PUBLISHED

Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor

Assigner: GitHub_M
Reserved: 24.03.2026 Published: 27.03.2026 Updated: 27.03.2026

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing ' can inject arbitrary JavaScript that executes inside every NativeTS script in that workspace. This is a code injection bug in worker.rs, not related to the sandbox/NSJAIL topic. Version 1.664.0 patches the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS Score: 7.3

Product Status

Vendor windmill-labs
Product windmill
Versions
  • Version < 1.664.0 is affected

References

Problem Types

  • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE