CVE-2026-33881
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs.
Published Mar 27, 2026 · updated Jun 17, 2026 · windmill windmill
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing can inject arbitrary JavaScript that executes inside every NativeTS script in that workspace. This is a code injection bug in , not related to the sandbox/NSJAIL topic. Version 1.664.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing can inject arbitrary JavaScript that executes inside every NativeTS
Jun 17, 2026 · NIST NVD
Updated
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environment variable with a value containing can inject arbitrary JavaScript that executes inside every NativeTS
Affected
- cpe windmill/windmillversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33881
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33881
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a
nvd.nist.gov