CVE-2026-33881: Windmill Developer Platform RCE Vulnerability

CVE-2026-33881 Overview

CVE-2026-33881 is a Code Injection vulnerability affecting Windmill, an open-source developer platform for internal code including APIs, background jobs, workflows, and UIs. The vulnerability exists in the NativeTS executor where workspace environment variable values are interpolated into JavaScript string literals without properly escaping single quotes. This flaw allows a workspace admin who sets a custom environment variable with a value containing a single quote character (') to inject arbitrary JavaScript code that executes inside every NativeTS script in that workspace.

Critical Impact

Workspace administrators can inject and execute arbitrary JavaScript code across all NativeTS scripts within a workspace, potentially compromising script integrity, data confidentiality, and system availability.

Affected Products

• Windmill versions prior to 1.664.0
• Windmill NativeTS Executor component (worker.rs)
• Workspaces utilizing custom environment variables in NativeTS scripts

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33881 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33881

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The issue stems from the worker.rs component in Windmill's NativeTS executor, which handles environment variable interpolation. When workspace environment variables are processed, their values are directly embedded into JavaScript string literals without sanitizing single quote characters. This creates an injection point that breaks out of the string context and allows arbitrary JavaScript execution.

The vulnerability is distinct from sandbox or NSJAIL-related security mechanisms—it is a straightforward code injection flaw in the variable interpolation logic. An attacker with workspace administrator privileges can craft a malicious environment variable value that, when interpolated, escapes the intended string boundary and injects executable JavaScript code.

Root Cause

The root cause is improper input sanitization in the worker.rs file of the Windmill codebase. When environment variable values are interpolated into JavaScript string literals, single quote characters are not escaped. This allows an attacker to terminate the string literal prematurely and inject arbitrary JavaScript code that will be executed in the context of every NativeTS script within the affected workspace.

Attack Vector

The attack vector requires network access and high-level privileges (workspace administrator). An attacker with administrative access to a Windmill workspace can:

1. Create or modify a workspace environment variable
2. Set the variable's value to include a single quote followed by malicious JavaScript code
3. The malicious code is then executed whenever any NativeTS script in that workspace runs

The injected code executes within the NativeTS executor context, potentially allowing data exfiltration, privilege abuse, or disruption of workflow operations. This is a network-accessible vulnerability that does not require user interaction once the malicious environment variable is set.

Detection Methods for CVE-2026-33881

Indicators of Compromise

• Unexpected environment variable values containing single quotes (') followed by JavaScript syntax
• Anomalous behavior or outputs from NativeTS scripts that were previously functioning normally
• Unauthorized data access or exfiltration attempts originating from script execution contexts

Detection Strategies

• Audit workspace environment variables for values containing single quote characters or JavaScript code patterns
• Monitor NativeTS script execution logs for unexpected JavaScript errors or behavior
• Implement code review processes for environment variable configurations in production workspaces
• Deploy application-level logging to capture environment variable changes by administrators

Monitoring Recommendations

• Enable detailed logging for environment variable creation and modification events
• Set up alerts for environment variable values matching patterns like '; <code> or ' + <expression>
• Monitor for unusual network activity or data access patterns during script execution
• Regularly review administrator actions within Windmill workspaces

How to Mitigate CVE-2026-33881

Immediate Actions Required

• Upgrade Windmill to version 1.664.0 or later immediately
• Audit all existing workspace environment variables for potentially malicious values
• Review recent administrator activity logs for suspicious environment variable changes
• Consider temporarily disabling custom environment variables in sensitive workspaces until patched

Patch Information

Windmill version 1.664.0 patches this vulnerability by properly escaping single quotes in environment variable values before interpolation into JavaScript string literals. Organizations should upgrade to this version or later as soon as possible. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Restrict workspace administrator privileges to trusted personnel only
• Implement manual review processes for any environment variable changes
• Avoid using environment variables with user-controllable or external data sources in NativeTS scripts
• Consider using alternative variable passing mechanisms that do not involve string interpolation until the patch is applied

# Upgrade Windmill to patched version
# Using Docker:
docker pull ghcr.io/windmill-labs/windmill:1.664.0
docker-compose up -d

# Verify version after upgrade
docker exec windmill-worker windmill --version