Windmill: Administradores de espacio de trabajo maliciosos pueden inyectar código a través de la interpolación sin escape de variables de entorno del espacio de trabajo en el ejecutor NativeTS

The vulnerability lies in the NativeTS executor's handling of workspace environment variables. Specifically, the platform fails to properly escape single quotes when interpolating these variables into JavaScript string literals. A malicious workspace administrator could leverage this by setting an environment variable with a value containing a single quote followed by arbitrary JavaScript code. This injected code will then execute within every NativeTS script running in that workspace, granting the attacker significant control over the platform's behavior. The potential impact includes data exfiltration, unauthorized code execution, and complete compromise of the affected workspace.

Organizations utilizing Windmill for internal development, particularly those with multiple workspace administrators or shared workspace environments, are at risk. Legacy Windmill deployments and those with relaxed environment variable security policies are especially vulnerable.

• rust / platform: Examine workspace environment variables for suspicious characters or code.

find . -name '*.env' -print0 | xargs -0 grep -E "['].*['" 

• rust / platform: Monitor NativeTS script execution logs for unexpected JavaScript code or errors. • generic web: Inspect Windmill workspace configurations for unusual environment variable settings. • generic web: Review Windmill access logs for attempts to manipulate environment variables.

1. 2026-03-27Disclosure

   disclosure

1. Reservado2026-03-24
2. Publicada2026-03-27
3. Modificada2026-04-01
4. EPSS actualizado2026-04-04

The primary mitigation is to upgrade Windmill to version 1.664.0 or later, which includes a fix for this vulnerability. If upgrading immediately is not feasible, consider restricting workspace administrator privileges to prevent malicious environment variable manipulation. Carefully review all environment variables set within workspaces for suspicious content. While a direct WAF rule is difficult to implement, monitoring for unusual JavaScript execution patterns within NativeTS scripts could provide an early warning sign of exploitation. After upgrading, confirm the fix by attempting to inject a single quote into an environment variable and verifying that the JavaScript is not executed.