CVE-2026-73081
Remote Code Execution via Command Injection in Code Step Name
01Record
| Identifier | CVE-2026-73081 |
|---|---|
| Project | Activepieces |
| Component | Code step name |
| CWE | CWE-78 |
| CVSS | 8.7 |
| Disclosed | 2026-07-17 |
| Endor reference | ENDOR-VUL-2026-30031 |
| Writeup | Link |
02Detail
Description: The Zod schema for a Code step's action name is z.string(): any string, no pattern. That name becomes a directory, and the directory path is interpolated into a build command invoked through /bin/sh, so shell metacharacters in the name escape the bun build and esbuild invocation. This is a shell-injection bug hiding under a type.
The sink runs before the sandbox is applied, so every execution mode is affected regardless of SANDBOX_CODE_ONLY, and in the default container image it runs as root. Affects Activepieces through 0.79.4.
Impact: Authenticated Remote Code Execution as root in the default container image, ahead of any sandbox.
Fixed in 0.80.0 (2026-03-31) by a STEP_NAME_REGEX allowlist plus spawn with an argv vector and shell: false (PR #12310). Full analysis is in the technical whitepaper.
Discovered by Peyton Kennedy (p80n), kodareef5, Aviral2642.