CVE-2026-73083: Activepieces Sandbox Bypass RCE Vulnerability

CVE-2026-73083 Overview

Activepieces is an open source AI workflow automation platform. CVE-2026-73083 is a sandbox escape affecting versions prior to 0.80.0 when running in SANDBOX_CODE_ONLY mode. The engine loads compiled user modules with importFresh(), a wrapper around Node.js require(), before the V8 isolate boundary is applied. Top-level module code executes in the host engine process and retains full access to Node.js APIs. An authenticated user who can create a Code step can invoke require('child_process'), access fs, and reach internal services. The issue is fixed in version 0.80.0 [CWE-693].

Critical Impact
Authenticated attackers with Code step privileges can read AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write arbitrary files, and pivot into internal services from the host engine process.

Affected Products

Activepieces workflow automation platform, versions prior to 0.80.0
Deployments running the engine in SANDBOX_CODE_ONLY mode
Self-hosted Activepieces instances exposing Code steps to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-73083 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73083

Vulnerability Analysis

Activepieces supports a SANDBOX_CODE_ONLY execution mode intended to restrict user-supplied JavaScript to a constrained V8 isolate. The engine compiles the user's Code step into a module and loads it into memory before the isolate boundary is enforced. Because importFresh() delegates to Node.js require(), any top-level statements in the loaded module execute in the host engine context. This gives untrusted code access to the full Node.js standard library, environment variables, and network stack of the engine process.

The practical consequence is a full escape from the intended JavaScript sandbox. An attacker who can author a Code step can spawn child processes, read the filesystem, exfiltrate secrets loaded into the engine's environment, and issue requests to services reachable from the host. Two secrets are of particular concern: AP_ENCRYPTION_KEY, used to encrypt stored connections and credentials, and AP_JWT_SECRET, used to sign authentication tokens. Disclosure of either enables further compromise of the platform and downstream integrations.

Root Cause

The root cause is an improper protection mechanism [CWE-693]. Sandbox isolation is applied after module loading rather than before. Top-level code in the user module runs before the V8 isolate can constrain it, defeating the security boundary the mode is meant to provide.

Attack Vector

Exploitation requires an authenticated account with permission to create a Code step. The attacker authors JavaScript that executes at module top level, calling require('child_process'), require('fs'), or process.env to read secrets and interact with the host. No user interaction beyond running the workflow is required. See the GitHub Security Advisory GHSA-gr3h-c2j7-r52g for advisory detail.

Detection Methods for CVE-2026-73083

Indicators of Compromise

Code step source referencing require('child_process'), require('fs'), require('net'), or direct reads of process.env.AP_ENCRYPTION_KEY or process.env.AP_JWT_SECRET.
Unexpected child processes spawned by the Activepieces engine process, especially shells or network utilities.
Outbound connections from the engine host to internal services that are not part of a documented piece integration.

Detection Strategies

Audit stored Code step definitions in the Activepieces database for Node.js built-in module imports that are not expected in customer flows.
Enable process and file-access telemetry on the engine host and alert on reads of environment files or configuration paths by the Node.js engine process.
Correlate workflow execution events with process creation and network connection events on the engine host to attribute host activity to specific Code steps and users.

Monitoring Recommendations

Log and review creation and modification events for Code steps, including the authoring user identity and diff of the code payload.
Alert on any use of child_process, fs, net, http, https, or dns inside user Code steps in versions prior to 0.80.0.
Monitor for reuse of AP_JWT_SECRET-signed tokens from unexpected source IPs, which may indicate secret exfiltration.

How to Mitigate CVE-2026-73083

Immediate Actions Required

Upgrade Activepieces to version 0.80.0 or later, which applies the V8 isolate before user module code executes.
Rotate AP_ENCRYPTION_KEY and AP_JWT_SECRET, and re-encrypt stored connections and credentials after rotation.
Restrict the ability to create or modify Code steps to trusted administrators until the upgrade is complete.
Review existing Code steps for references to Node.js built-in modules and remove any that are not authorized.

Patch Information

The fix is available in Activepieces 0.80.0. See the GitHub Release 0.80.0 and the GitHub Security Advisory GHSA-gr3h-c2j7-r52g for release notes and remediation guidance.

Workarounds

Disable the Code step piece entirely for non-administrative users until the platform is upgraded.
Run the Activepieces engine in a dedicated, network-segmented container with no access to internal services or secret stores beyond what is strictly required.
Remove sensitive environment variables from the engine process and source them from an external secrets broker fetched only at execution time, reducing what a top-level process.env read can disclose.

bash

# Upgrade example for a Docker-based deployment
docker pull activepieces/activepieces:0.80.0
docker compose down
# Update the image tag in docker-compose.yml to 0.80.0
docker compose up -d

# Rotate secrets after upgrade
openssl rand -hex 32   # new AP_ENCRYPTION_KEY
openssl rand -hex 32   # new AP_JWT_SECRET