CVE-2026-73081

Name of the Vulnerable Software and Affected Versions Activepieces versions prior to 0.80.0

Description The worker's code-compilation pipeline constructs the on-disk path for a Code step using the step's name and passes this path to a shell-invoked build command. An authenticated user with permissions to create or edit a flow can use shell metacharacters within the step name to break out of the intended build invocation. This allows the execution of arbitrary commands as the worker process user during compilation, occurring before the code sandbox is established. Potential impacts include reading and writing to the worker filesystem, exfiltrating environment secrets, and accessing internal services available to the worker.

Recommendations Update to version 0.80.0.