ToolJet vulnerabilities

In ToolJet prior to version 3.20.178-lts, any authenticated user with builder role (free tier) could overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executed server-side with full Node.js access. The malicious code ran whenever any user on the instance triggered a query using that plugin, leading to remote code execution (RCE) and supply-chain compromise of the entire ToolJet deployment.

ToolJet, an open-source platform for building internal tools, prior to version 3.20.207 has a vulnerability in the ToolJet Database HTTP API that authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. An authenticated user can set tj-workspace-id to their own workspace and target another workspace, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.

A vulnerability in ToolJet before 3.20.180 allows shell command injection via pull request comments. The CI runner executes code from the comment, enabling theft of deployment secrets.

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.

A vulnerability in Tooljet v1.6 arises from improper handling of missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.