CVE-2026-100865

Summary

The flaw allows authenticated users to execute arbitrary Python and OS commands, posing a significant risk due to insufficient sandboxing of workflow condition expressions.

Exploitability

Exploitation is moderately hard as it requires authenticated access and editing of workflow condition nodes or importing malicious templates.

Blast radius

If exploited, the impact could be severe, as it allows for arbitrary command execution as the backend process user, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.0.53 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.