Windmill is an open-source developer platform that interpolates workspace environment variable values into JavaScript string literals without escaping single quotes in its NativeTS executor. A workspace administrator who sets a custom environment variable containing a single quote can inject arbitrary JavaScript, which then executes inside every NativeTS script running in that workspace. This code injection flaw can lead to unauthorized script execution, manipulation of data, and potential privilege escalation within the workspace environment.

Windmill Labs’ Windmill platform is affected. All releases prior to version 1.664.0 contain the vulnerability. The issue is specifically in the NativeTS executor’s worker.rs component. Versions 1.664.0 and later include a fix.

The CVSS score of 7.3 reflects a high severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must have workspace administrator privileges to set the malicious environment variable, so the exploitation vector is internal. Once set, the injected code executes each time a NativeTS script runs, providing persistent code execution within the workspace.