An OS Command Injection vulnerability in Activepieces allows authenticated users to execute arbitrary system commands, leading to full server compromise.

The software fails to properly neutralize special elements used in OS commands (CWE-78). An authenticated attacker can manipulate input parameters to execute arbitrary commands at the operating system level, effectively bypassing application-level restrictions.

The CVSS score of 8.7 highlights the critical nature of this vulnerability, as it allows for full system control by an authenticated user. This could lead to unauthorized access to sensitive workflow data, lateral movement within the network, or the installation of persistent malicious backdoors. The impact is elevated if the platform is integrated with highly privileged cloud services or internal infrastructure.

Immediate Action: Upgrade the Activepieces platform to version 0.80.0 or later as provided in the official release notes.

Proactive Monitoring: Inspect server logs for unusual process execution patterns or unauthorized attempts to access system-level binaries and configuration files.

Compensating Controls: Restrict access to the Activepieces administrative interface to trusted users only, and run the service with the least privilege necessary to minimize the potential impact of command execution.

Public Exploit Available: False

Given the potential for complete system takeover, administrators should upgrade to version 0.80.0 immediately. Organizations should also review the access logs of the platform to ensure that no unauthorized users have utilized this vector to gain persistent access.