What happened
GitHub release notes and NVD published CVE-2026-73081 (CVSS 8.7) and CVE-2026-73083 (CVSS 7.6) describing command-injection and sandbox-bypass flaws in Activepieces' code-execution pipeline for AI agent workflow steps.
Why it matters
Activepieces is an open-source AI workflow/agent automation platform; both flaws let a workflow author (potentially a low-privileged user or content injected via an AI agent's generated code) achieve full command execution on the worker host, defeating the sandboxing meant to isolate untrusted workflow code.
Attack vector
The worker's code-compilation pipeline builds an on-disk path for a Code step from the step's name and passes it to a shell-invoked build command; a step name containing shell metacharacters breaks out of the intended argument context to execute arbitrary shell commands. A related flaw (CVE-2026-73083) allows the compiled module (loaded via importFresh()/require() before V8 isolation is applied) to call require('child_process') and escape the SANDBOX_CODE_ONLY execution boundary entirely.
Affected systems
Activepieces < 0.80.0
Mitigation
Upgrade to Activepieces >= 0.80.0.