CVE-2026-48499
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.
Risk Assessment
An attacker can access sensitive data of other tenants and execute malicious code in their context, leading to tenant isolation breach.
Recommendation
Update Activepieces to version 0.84.0 or later, which contains the fix.
Other vulnerabilities in Activepieces
See all- CVE-2026-73084Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
- CVE-2026-73083High
Activepieces prior to 0.80.0 in SANDBOX_CODE_ONLY mode loads the user module before applying the V8 isolate, allowing access to Node.js APIs outside the sandbox. An authenticated user can read environment secrets, files, and reach internal services.
- CVE-2026-73082Medium
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability. This issue is fixed in version 0.82.0.
- CVE-2026-73081High
Activepieces prior to 0.80.0 has a vulnerability in the code compilation pipeline where a step name can contain shell metacharacters, allowing arbitrary command execution during compilation. An authenticated user can execute commands as the worker process.
- CVE-2026-53536Medium
In Activepieces prior to version 0.83.0, the /v1/step-files/signed endpoint did not verify the JWT audience and lacked a null check for decoded fileId. This allowed an authenticated user to retrieve step-files belonging to other tenants on the same instance.
- CVE-2026-53535Medium
In Activepieces before version 0.82.0, the git-sync feature allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. This was due to Git symbolic-link handling not being disabled and insufficient validation of user-supplied identifiers (repository slug, externalId of tables, flows, connections) against directory-traversal sequences.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.