CVE-2026-54344
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in ToolJet before 3.20.180 allows shell command injection via pull request comments. The CI runner executes code from the comment, enabling theft of deployment secrets.
Risk Assessment
An attacker can compromise CI/CD secrets, leading to unauthorized access to production environments and data leakage.
Recommendation
Immediately upgrade ToolJet to version 3.20.180 or later. Restrict commenting on pull requests to trusted users only.
Other vulnerabilities in ToolJet
See all- CVE-2026-55413Critical
In ToolJet prior to version 3.20.178-lts, any authenticated user with builder role (free tier) could overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executed server-side with full Node.js access. The malicious code ran whenever any user on the instance triggered a query using that plugin, leading to remote code execution (RCE) and supply-chain compromise of the entire ToolJet deployment.
- CVE-2026-73068Medium
ToolJet, an open-source platform for building internal tools, prior to version 3.20.207 has a vulnerability in the ToolJet Database HTTP API that authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. An authenticated user can set tj-workspace-id to their own workspace and target another workspace, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.
- CVE-2022-27979Medium
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
- CVE-2022-27978High
A vulnerability in Tooljet v1.6 arises from improper handling of missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
Original NVD description (English source)
ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a deploy command to execute shell commands on the CI runner and exfiltrate deployment secrets. This issue is reported as fixed in version 3.20.180.