CVE-2026-33881: Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing ' can inject arbitrary JavaScript that executes inside every NativeTS script in that workspace. This is a code injection bug in worker.rs, not related to the sandbox/NSJAIL topic. Version 1.664.0 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33881?
CVE-2026-33881 is considered a high severity vulnerability due to the potential for arbitrary code injection.
How do I fix CVE-2026-33881?
To fix CVE-2026-33881, update Windmill to version 1.664.0 or later to mitigate the code injection risk.
Who is affected by CVE-2026-33881?
CVE-2026-33881 affects users of Windmill versions prior to 1.664.0 where rogue workspace admins can exploit environment variable interpolation.
What type of attack is possible with CVE-2026-33881?
CVE-2026-33881 allows attackers to inject and execute arbitrary code through unescaped workspace environment variable interpolation.
What should I do if I cannot update Windmill to fix CVE-2026-33881?
If you cannot update Windmill, mitigate CVE-2026-33881 by restricting access to trusted workspace admins only.