Critical
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
Type: advisorySources: OSV
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-48499
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 01:23 UTC · Revision 1
Source evidence
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
core-osv · Original sourcePublished 30 Jul 2026, 17:10 UTC
Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.
osv:CVE-2026-48499
Complete source record
{
"id": "275c17e88a615f8a039c2f4ac98c5fa5b494e34f1767eaac4cf56028e69a8cac",
"url": "https://osv.dev/vulnerability/CVE-2026-48499",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache",
"summary": "Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.",
"evidence": "osv:CVE-2026-48499",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-48499",
"aliases": [
"CVE-2026-48499",
"GHSA-5h2x-g6m3-grmq"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/activepieces/activepieces",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "05354b374a52b6611adfc9816a484cfeadf15702"
},
{
"fixed": "9d8d328424bd32d295c5727af7550e1b57f9074d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.84.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "9d8d328424bd32d295c5727af7550e1b57f9074d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "05354b374a52b6611adfc9816a484cfeadf15702"
}
],
"source": "REFERENCES_TAG",
"original_tag": "0.84.0"
}
]
}
}
],
"versions": [
"0.75.0",
"0.80.1",
"0.80.0",
"0.80.0-rc",
"0.79.0",
"0.78.2",
"0.78.1",
"0.78.0",
"0.77.6",
"0.77.5",
"0.77.4",
"0.77.3",
"0.77.2",
"0.76.2",
"0.77.1",
"0.74.4",
"0.74.3",
"0.76.0",
"0.74.0",
"0.73.0",
"0.72.3",
"0.72.2",
"0.72.1",
"0.72.0",
"0.71.4",
"0.71.3",
"0.71.1",
"0.71.0",
"0.70.8",
"0.70.7",
"0.70.6",
"0.70.5",
"0.70.4",
"0.70.3",
"0.70.2",
"0.70.1",
"0.69.0",
"0.70.0",
"0.67.2",
"0.68.2",
"0.68.3",
"0.68.0",
"0.68.1",
"0.67.6",
"0.67.5",
"0.67.4",
"0.67.3",
"0.67.1",
"0.67.0",
"0.66.7",
"0.66.6",
"0.66.5",
"0.66.4",
"0.66.3",
"0.65.0",
"0.66.2",
"0.66.1",
"0.66.0",
"0.64.2",
"0.64.1",
"0.64.0",
"0.63.0",
"0.64.0-rc.0",
"0.60.2",
"0.60.0",
"0.59.0",
"0.57.1",
"0.57.0",
"0.56.0",
"0.54.0",
"0.53.1",
"0.53.0",
"0.50.12",
"0.50.11",
"0.50.10",
"0.50.9",
"0.50.8",
"0.50.7",
"0.50.5",
"0.50.4",
"0.50.3",
"0.50.2",
"0.50.1",
"0.50.0",
"0.49.0",
"0.48.7",
"0.49.0-rc.0",
"0.48.6",
"0.48.3",
"0.48.2",
"0.48.1",
"0.48.0",
"0.47.4",
"0.47.2",
"0.46.7",
"0.46.6",
"0.46.5",
"0.46.3",
"0.46.0",
"0.45.1",
"0.45.0",
"0.42.0",
"0.42.0-rc.1",
"0.41.0",
"0.41.0-rc.1",
"0.39.9",
"0.39.7",
"0.39.6",
"0.39.5",
"0.39.4",
"0.39.3",
"0.39.2",
"0.39.1",
"0.39.0",
"0.38.6",
"0.38.3",
"0.38.2",
"0.38.1",
"0.38.0",
"0.37.6",
"0.37.5",
"0.37.4",
"0.37.3",
"0.37.2",
"0.37.1",
"0.37.0",
"0.36.4",
"0.36.3",
"0.36.2",
"0.36.1",
"0.36.0",
"0.35.1",
"0.35.0",
"0.34.11",
"0.30.0-rc.8",
"0.30.0-rc.7",
"0.30.0-rc.6",
"0.30.0-rc.5",
"0.30.0-rc.4",
"0.30.0-rc.3",
"0.30.0-rc.1",
"0.29.1",
"0.29.0",
"0.29.0-rc.3",
"0.29.0-rc.1",
"0.28.0-rc.1",
"0.28.0",
"0.27.0",
"0.27.0-rc.8",
"0.27.0-rc.7",
"0.27.0-rc.6",
"0.27.0-rc.5",
"0.27.0-rc.4",
"0.27.0-rc.3",
"0.27.0-rc.2",
"0.27.0-rc.1",
"0.26.1",
"0.26.0",
"0.26.0-rc.3",
"0.26.0-rc.2",
"0.26.0-rc.1",
"0.25.0",
"0.25.1",
"0.24.1",
"0.24.0",
"0.23.0",
"0.23.0-rc.2",
"0.23.0-rc.1",
"0.22.0-rc.4",
"0.22.0-rc.3",
"0.22.0-rc.1",
"0.21.0",
"0.21.0-rc.4",
"0.21.0-rc.2",
"0.21.0-rc.1",
"0.20.3",
"0.20.2",
"0.20.1",
"0.20.0",
"0.20.0-rc.4",
"0.20.0-rc.3",
"0.20.0-rc.2",
"0.19.0",
"0.19.0-rc.4",
"0.19.0-rc.3",
"0.19.0-rc.2",
"0.19.0-rc.1",
"0.18.2",
"0.18.1",
"0.18.0",
"0.18.0-rc.1",
"0.17.0",
"0.16.0",
"0.16.0-rc.3",
"0.16.0-rc.2",
"0.16.0-rc.1",
"0.15.0",
"0.15.0-rc.8",
"0.15.0-rc.7",
"0.15.0-rc.6",
"0.15.0-rc.4",
"0.15.0-rc.5",
"0.15.0-rc.3",
"0.15.0-rc.2",
"0.7.0",
"0.4.0",
"0.3.15",
"0.3.6",
"0.3.5",
"0.3.3",
"0.2.5",
"0.2.0",
"0.1.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48499.json"
}
}
],
"modified": "2026-10-28T02:30:41.114947312Z",
"provider": "osv",
"references": [
"https://github.com/activepieces/activepieces/releases/tag/0.84.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48499.json",
"https://github.com/activepieces/activepieces/security/advisories/GHSA-5h2x-g6m3-grmq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-48499",
"https://github.com/activepieces/activepieces/commit/9d8d328424bd32d295c5727af7550e1b57f9074d"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200",
"CWE-285",
"CWE-668",
"CWE-732"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48499.json"
}
},
"related_cves": [
{
"value": "CVE-2026-48499",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509039,
"published_at": "2026-07-30T17:10:28.347+00:00"
}