Security: windmill-labs/windmill
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Under nsjail security sandboxing, DuckDB scripts can escape the fs sandbox and poison shared worker caches for cross-workspace RCEGHSA-2jfj-x8j7-7mfh published
Sep 10, 2026 by rubenfiszelHigh -
Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_searchGHSA-2ppx-66jv-wpw5 published
Jun 3, 2026 by rubenfiszelLow -
Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executorGHSA-8q8j-mm3g-5c2q published
Mar 25, 2026 by rubenfiszelLow -
SUPERADMIN_SECRET (rarely used) can be accessed publicly on versions < 1.603.3 using RCEGHSA-24fr-44f8-fqwg published
Mar 2, 2026 by rubenfiszelHigh -
Workspace Slack OAuth Client Secret Exposed to Non-Admin Workspace MembersGHSA-f27g-j463-q85w published
Feb 16, 2026 by rubenfiszelLow
Learn more about advisories related to windmill-labs/windmill in the GitHub Advisory Database