CVE-2026-73083
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Activepieces prior to 0.80.0 in SANDBOX_CODE_ONLY mode loads the user module before applying the V8 isolate, allowing access to Node.js APIs outside the sandbox. An authenticated user can read environment secrets, files, and reach internal services.
Risk Assessment
Exposure of secrets (e.g., encryption keys) and access to internal resources can lead to full platform compromise.
Recommendation
Update Activepieces to version 0.80.0 or later.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('child_process'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0.