CVE-2026-82278

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82278
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82278.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82278
Published
2026-08-28T16:18:58Z
Modified
2026-08-30T03:48:23Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once
Details

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82278.json"
}
References

Affected packages

Git / github.com/dataelement/bisheng

Affected ranges

Type
GIT
Repo
https://github.com/dataelement/bisheng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a3788115d71f4b5888a34fbe7e1f0f3f9f13784c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*
v0.1.1
v0.1.10
v0.1.10.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.9.1
v0.1.9.2
v0.1.9.3
v0.1.9.4
v0.1.9.5
v0.2.0
v0.2.0_rc1
v0.2.1
v0.2.1.2
v0.2.2
v0.2.2.1
v0.2.2.2
v0.2.2.3
v0.2.2.4
v0.2.2.5
v0.2.2.6
v0.2.3
v0.2.3.2
v0.3.0beta
v0.3.0rc0
v0.3.0rc1
v0.3.1
v0.3.1.1
v0.3.1.2
v0.3.2
v0.3.2.1
v0.3.2.2
v0.3.3.dev1
v0.3.3.dev2
v0.3.3beta
v0.3.3rc1
v0.3.4
v0.3.4.dev1
v0.3.4.dev2
v0.3.4.dev3
v0.3.5.dev1
v0.3.6.dev1
v0.3.7
v0.3.7.1
v0.3.7.dev1
v0.3.7.dev2
v0.4.0.dev1
v0.4.0.dev2
v0.4.1
v0.4.1.1
v0.4.1.2
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.2.0
v2.2.0-beta1
v2.2.0-beta2
v2.2.0-beta3
v2.3.0
v2.3.0-beta1
v2.3.0-beta2
v2.3.0-beta3
v2.4.0-beta1
v2.4.0-beta1-fix

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82278.json"