CVE-2026-73084: falha de média gravidade em activepieces
Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.4%
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
activepieces · activepiecesCVEs relacionadas — activepieces
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53535MEDIUMActivepieces: Arbitrary file write in git-sync via path traversal and symlinksEPSS 0.8%CVE-2026-73081HIGHActivepieces: Remote Code Execution via Command Injection in Code Step NameEPSS 0.5%CVE-2026-73082MEDIUMActivepieces: Server-side request forgery in MCP tool validation endpointEPSS 0.4%CVE-2026-48499CRITICALActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheEPSS 0.4%CVE-2026-73083HIGHActivepieces: V8 Isolate Sandbox Bypass via importFresh Module LoadingEPSS 0.3%CVE-2026-53536MEDIUMActivepieces: Cross-tenant file download via missing JWT audience check on step-files signed URLEPSS 0.2%