Vipinxsec

An authenticated user with permissions to create or modify workflows containing a Python Code Node can escape the sandbox to achieve arbitrary code execution on the task runner container. This issue specifically affects instances where the Python Task Runner is enabled.

The issue allows for stored XSS via an uploaded HTML document. This means an attacker can upload a malicious HTML file to the system, which can then execute scripts on the user's browser, potentially leading to unauthorized actions or data theft.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `virtual del` parameter. This can lead to the execution of malicious scripts on the client-side.