Windmill Labs vulnerabilities
We track 5 vulnerabilities in Windmill Labs products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 19, 2026.
Latest Windmill Labs vulnerabilities
- 8.1 High severity
windmill: Incorrect Default Permissions
Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/reso
- 9.9 Critical severity
Windmill CE (Community Edition): Improper Neutralization of Special Elements used in an SQL Command
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read
- 8.8 High severity
Windmill CE (Community Edition): Missing Authorization
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as
- 7.2 High severity
windmill: Improper Control of Generation of Code
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspa
- 7.5 High severity
windmill: Improper Limitation of a Pathname to a Restricted Directory
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_