CVE-2026-73083

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73083
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73083.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73083
Aliases
  • GHSA-gr3h-c2j7-r52g
Published
2026-08-11T16:33:22.045Z
Modified
2026-08-15T11:30:57.742431183Z
Severity
  • 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading
Details

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('childprocess'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including APENCRYPTIONKEY and APJWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0.

Database specific 
{
    "cwe_ids": [
        "CWE-693"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73083.json"
}
References

Affected packages

Git / github.com/activepieces/activepieces

Affected ranges

Type
GIT
Repo
https://github.com/activepieces/activepieces
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d45da9632b487c6767d88108ee0d3777ea79b54
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.80.0"
        }
    ]
}

Affected versions

0.*
0.1.3
0.15.0
0.15.0-rc.2
0.15.0-rc.3
0.15.0-rc.4
0.15.0-rc.5
0.15.0-rc.6
0.15.0-rc.7
0.15.0-rc.8
0.16.0
0.16.0-rc.1
0.16.0-rc.2
0.16.0-rc.3
0.17.0
0.18.0
0.18.0-rc.1
0.18.1
0.18.2
0.19.0
0.19.0-rc.1
0.19.0-rc.2
0.19.0-rc.3
0.19.0-rc.4
0.2.0
0.2.5
0.20.0
0.20.0-rc.2
0.20.0-rc.3
0.20.0-rc.4
0.20.1
0.20.2
0.20.3
0.21.0
0.21.0-rc.1
0.21.0-rc.2
0.21.0-rc.4
0.22.0-rc.1
0.22.0-rc.3
0.22.0-rc.4
0.23.0
0.23.0-rc.1
0.23.0-rc.2
0.24.0
0.24.1
0.25.0
0.25.1
0.26.0
0.26.0-rc.1
0.26.0-rc.2
0.26.0-rc.3
0.26.1
0.27.0
0.27.0-rc.1
0.27.0-rc.2
0.27.0-rc.3
0.27.0-rc.4
0.27.0-rc.5
0.27.0-rc.6
0.27.0-rc.7
0.27.0-rc.8
0.28.0
0.28.0-rc.1
0.29.0
0.29.0-rc.1
0.29.0-rc.3
0.29.1
0.3.15
0.3.3
0.3.5
0.3.6
0.30.0-rc.1
0.30.0-rc.3
0.30.0-rc.4
0.30.0-rc.5
0.30.0-rc.6
0.30.0-rc.7
0.30.0-rc.8
0.34.11
0.35.0
0.35.1
0.36.0
0.36.1
0.36.2
0.36.3
0.36.4
0.37.0
0.37.1
0.37.2
0.37.3
0.37.4
0.37.5
0.37.6
0.38.0
0.38.1
0.38.2
0.38.3
0.38.6
0.39.0
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.39.6
0.39.7
0.39.9
0.4.0
0.41.0
0.41.0-rc.1
0.42.0
0.42.0-rc.1
0.45.0
0.45.1
0.46.0
0.46.3
0.46.5
0.46.6
0.46.7
0.47.2
0.47.4
0.48.0
0.48.1
0.48.2
0.48.3
0.48.6
0.48.7
0.49.0
0.49.0-rc.0
0.50.0
0.50.1
0.50.10
0.50.11
0.50.12
0.50.2
0.50.3
0.50.4
0.50.5
0.50.7
0.50.8
0.50.9
0.53.0
0.53.1
0.54.0
0.56.0
0.57.0
0.57.1
0.59.0
0.60.0
0.60.2
0.63.0
0.64.0
0.64.0-rc.0
0.64.1
0.64.2
0.65.0
0.66.0
0.66.1
0.66.2
0.66.3
0.66.4
0.66.5
0.66.6
0.66.7
0.67.0
0.67.1
0.67.2
0.67.3
0.67.4
0.67.5
0.67.6
0.68.0
0.68.1
0.68.2
0.68.3
0.69.0
0.7.0
0.70.0
0.70.1
0.70.2
0.70.3
0.70.4
0.70.5
0.70.6
0.70.7
0.70.8
0.71.0
0.71.1
0.71.3
0.71.4
0.72.0
0.72.1
0.72.2
0.72.3
0.73.0
0.74.0
0.74.3
0.74.4
0.75.0
0.76.0
0.76.2
0.77.1
0.77.2
0.77.3
0.77.4
0.77.5
0.77.6
0.78.0
0.78.1
0.78.2
0.79.0
0.80.0-rc

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73083.json"