CVE-2026-33881 Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspace admin who sets a custom environmen...

WindMill 代码注入漏洞

WindMill is a free open-source tool developed by Lukasavicus’ individual developer. It is used to control the execution of tasks in Python. Versions of WindMill prior to 1.664.0 contained a code injection vulnerability. This vulnerability occurred when JavaScript string literals were inserted int...

Terraform Enterprise May Capture Sensitive Data In Logs

Summary Terraform Enterprise was configured to log inbound HTTP requests in a manner that may capture sensitive data. This vulnerability, CVE-2022-25374, was fixed in Terraform Enterprise v202202-1. Background Terraform Enterprise TFE is an application that helps teams use Terraform together, wit...