Activepieces vulnerabilities

In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.

Activepieces prior to 0.80.0 in SANDBOX_CODE_ONLY mode loads the user module before applying the V8 isolate, allowing access to Node.js APIs outside the sandbox. An authenticated user can read environment secrets, files, and reach internal services.

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability. This issue is fixed in version 0.82.0.

Activepieces prior to 0.80.0 has a vulnerability in the code compilation pipeline where a step name can contain shell metacharacters, allowing arbitrary command execution during compilation. An authenticated user can execute commands as the worker process.

In Activepieces prior to version 0.83.0, the /v1/step-files/signed endpoint did not verify the JWT audience and lacked a null check for decoded fileId. This allowed an authenticated user to retrieve step-files belonging to other tenants on the same instance.

In Activepieces before version 0.82.0, the git-sync feature allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. This was due to Git symbolic-link handling not being disabled and insufficient validation of user-supplied identifiers (repository slug, externalId of tables, flows, connections) against directory-traversal sequences.