CVE-2026-82278
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.
Risk Assessment
The risk includes full server compromise, access to sensitive data and credentials, and potential movement within the internal network, potentially leading to severe security breach.
Recommendation
Immediately update BISHENG to version 2.6.0 or later and implement sandboxing for executed code. Also restrict access to the /run_once endpoint.
Other vulnerabilities in BISHENG
Original NVD description (English source)
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.