Windmill-labs windmill, an open-source developer platform, suffers from a CWE-94 improper code generation vulnerability due to unsafe interpolation of workspace environment variables into JavaScript string literals in the NativeTS executor. Specifically, single quotes in environment variable values are not escaped, enabling a workspace admin to inject arbitrary JavaScript code that executes in all NativeTS scripts within that workspace. This vulnerability exists in versions before 1.664.0 and is fixed in version 1.664.0. The CVSS 4.0 score is 7.3, indicating high severity, with network attack vector, low attack complexity, and no user interaction required.

An attacker with workspace administrator privileges can exploit this vulnerability to execute arbitrary JavaScript code within the NativeTS execution environment of the affected windmill workspace. This could lead to unauthorized code execution, potentially compromising the integrity and confidentiality of the environment and any processes running within it. The vulnerability does not require user interaction and can be exploited remotely over the network by an authorized workspace admin.

Upgrade windmill to version 1.664.0 or later, where this code injection vulnerability is patched. Since this is a vulnerability in the open-source software, applying the official fix is the recommended remediation. No additional mitigations are indicated by the vendor advisory.