Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

windmill-labs/windmill

              main @ 51e1eba
            

236

Fixes

CVEs

CRITICAL

Peak severity

29.4%

Coverage

Highlights

Auth Bypass: 112 prior fixes. Scrutinize any change in this area.

backend/windmill-api/src/jobs.rs: most-fixed (21 issues). Treat as high-risk during review.

156 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The platform relies on complex, granular role/scope validation (e.g. Viewer, Operator, Publisher) which has historically been bypassed under alternate execution modes or missing checks. For example, CVE-2026-22683 allowed operators to bypass validation via unpinned raw_code blocks, and multiple endpoints failed to restrict Operator roles from mutating apps, flows, and scripts.

Path Traversal: The platform serves logs and reads workspace files directly from disk. Missing canonicalization and prefix checks on the get_log_file endpoint allowed unauthenticated arbitrary remote file reads (CVE-2026-29059), while related endpoints struggled with symbolic-link traversal inside job execution sandboxes.

Code Injection: User-supplied variables and script configurations (such as custom package names, entry points, or single quotes in NativeTS/Bun environment variables) were historically interpolated directly into wrapper scripts or config files rather than being written to structured files or sanitized. This led to arbitrary code injection pathways.