@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +80 more potentially affected by CVE-2026-110095 via fast-uri (>=3.0.1, <=3.1.8)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =0.6.49, =1.2.0, =0.0.9, =0.15.1, =0.15.4 - @kubohiroya/turbowarp-camera-source 0.17.1 - @kubohiroya/turbowarp-cloudflare-worker 0.3.1 - @kubohiroya/turbowarp-diagnostic-overlay 0.5.1 and more Source cves: CVE-2026-110095 Source...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +80 more potentially affected by CVE-2026-110725 via fast-uri (>=3.0.1, <=3.1.8)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =0.6.49, =1.2.0, =0.0.9, =0.15.1, =0.15.4 - @kubohiroya/turbowarp-camera-source 0.17.1 - @kubohiroya/turbowarp-cloudflare-worker 0.3.1 - @kubohiroya/turbowarp-diagnostic-overlay 0.5.1 and more Source cves: CVE-2026-110725 Source...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +80 more potentially affected by CVE-2026-110725 via fast-uri (>=3.0.1, <=3.1.8)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =0.6.49, =1.2.0, =0.0.9, =0.15.1, =0.15.4 - @kubohiroya/turbowarp-camera-source 0.17.1 - @kubohiroya/turbowarp-cloudflare-worker 0.3.1 - @kubohiroya/turbowarp-diagnostic-overlay 0.5.1 and more Source cves: CVE-2026-110725 Source...

@activepieces/piece-activecampaign (>=0.1.4, <=0.1.5), @activepieces/piece-activepieces (0.4.5) +1214 more potentially affected by CVE-2026-111756 via follow-redirects (>=1.11.0, <=1.16.0)

follow-redirects NPM version =1.11.0, =0.1.4, =0.0.1, =0.3.5, =0.0.1, =0.1.2 - @activepieces/piece-air-ops 0.1.5 - @activepieces/piece-aircall 0.1.5 - @activepieces/piece-airparser 0.1.4 and more Source cves: CVE-2026-111756 Source advisory: MEND:CVE-2026-111756...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +80 more potentially affected by CVE-2026-110095 via fast-uri (>=3.0.1, <=3.1.8)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =0.6.49, =1.2.0, =0.0.9, =0.15.1, =0.15.4 - @kubohiroya/turbowarp-camera-source 0.17.1 - @kubohiroya/turbowarp-cloudflare-worker 0.3.1 - @kubohiroya/turbowarp-diagnostic-overlay 0.5.1 and more Source cves: CVE-2026-110095 Source...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +37 more potentially affected by CVE-2026-86472 via fast-uri (>=3.0.1, <=3.1.7)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.2, =2.7.9, =5.4.3, =0.2.0-alpha.5, =0.2.0-alpha.12 and more Source cves: CVE-2026-86472 Source advisory: OSV:GHSA-HRR3-GC8F-F4QJ...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +9 more potentially affected by CVE-2026-102277 via brace-expansion (>=2.0.0, <=2.1.4)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =0.3.0, =0.5.4 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-102277 Source advisory: GHSA-Q2HR-2G5M-VWHR...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +9 more potentially affected by CVE-2026-102277 via brace-expansion (>=2.0.0, <=2.1.4)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =0.3.0, =0.5.4 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-102277 Source advisory: MEND:CVE-2026-102277...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +27 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.25 and more Source cves: CVE-2026-76172 Source advisory: GHSA-JQFF-G426-HQXP...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @clowder-ai/feishu-meeting-intake (0.1.0-alpha.13) +27 more potentially affected by CVE-2026-76172 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.25 and more Source cves: CVE-2026-76172 Source advisory: MEND:CVE-2026-76172...

CVE-2026-73083

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-73082

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

CVE-2026-73084

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73081

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

EUVD-2026-56552

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73084

Activepieces (before 0.83.0) contains a reflected XSS in the /api/redirect OAuth callback where the user-supplied code parameter is embedded in an inline script without proper escaping. A crafted request can break out of the script context and run arbitrary JavaScript in the user’s session, poten...

CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73084

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...