CVE-2026-100864

Summary

This vulnerability allows authenticated users to execute arbitrary Python code through the expression engine's DotList map/filter and fallback resolver, posing a significant risk due to the potential for remote code execution.

Exploitability

Exploitation is relatively straightforward for attackers who can craft workflow expressions to access os.system and execute commands. Precondition is the user must be authenticated and have access to the affected feature.

Blast radius

If exploited, the impact could be severe, as it allows for arbitrary command execution, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.0.91 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.