CyberRota Analysis
AI-GeneratedActivepieces, an open-source AI workflow automation platform, is vulnerable in versions prior to 0.80.0, allowing authenticated users to execute Node.js APIs outside the intended sandbox environment. This flaw enables access to sensitive environment variables, file system manipulation, and interaction with internal services, posing a significant security risk. Organizations using affected versions should prioritize upgrading to 0.80.0 or later to mitigate potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('child_process'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0.