Breaking Down Three Activepieces Vulnerabilities in Code Execution Pipelines
Three Activepieces CVEs, two of which execute before the V8 isolate exists. The sandbox timeline, the mode matrix, and why require() runs the module.
Three active vulnerabilities have been identified in the Activepieces code execution pipeline. The first CVE (CVE-2026-73081) is a reflected XSS vulnerability that places attacker data inside a script block before the isolate exists. The second and third CVEs (CVE-2026-73083 and CVE-2026-73084) have the same underlying failure but occur at different points in the execution timeline.
All three vulnerabilities are present in Activepieces, an open-source workflow automation platform, which allows users to write JavaScript code that runs as part of a flow.
Activepieces offers four execution modes, but the SANDBOX_CODE_AND_PROCESS mode is the only one where the V8 isolate is load-bearing. The sandbox is not a feature but the product itself, and the boundary where the boundary begins is critical. The payload in the XSS vulnerability rides in the name of the Code step, which crosses the trust boundary during compilation and is executed before the sandbox is created.
This vulnerability can allow an attacker to read and write the worker filesystem, pull environment secrets, and reach the internal API, potentially compromising the entire system. The vulnerabilities were reported by three researchers within a three-week period, indicating a previously under-audited surface.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
