Windmill vulnerabilities

3 known vulnerabilities in Windmill from Windmill Labs. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  windmill: Incorrect Default Permissions

  CVE-2026-47107May 19, 2026Windmill Labs

  Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/reso

• 7.2 High severity

  windmill: Improper Control of Generation of Code

  CVE-2026-33881Mar 27, 2026Windmill Labs

  Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A workspa

• 7.5 High severity

  windmill: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-29059Mar 6, 2026Windmill LabsEPSS 3.05%

  Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_