CVE-2026-73083 Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-73083

Activepieces prior to 0.80.0 runs user code in SANDBOX_CODE_ONLY by loading modules with importFresh() before the V8 isolate is applied. This allows top-level code to call Node.js APIs (e.g., child_process, fs) in the host engine process, enabling an authenticated Code step user to read environme...