CVE-2026-55413 Details
Description
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, any authenticated user with builder role (free tier) can overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executes server-side with full Node.js access (require, process). The malicious code runs whenever any user on the instance triggers a query using that plugin — achieving both RCE and supply-chain compromise of the entire ToolJet deployment. This vulnerability is fixed in 3.20.178-lts.
A vulnerability in ToolJet versions prior to 3.20.178-lts allows any authenticated user with a builder role on the free tier to overwrite a globally shared marketplace plugin. The injected JavaScript executes server-side with full Node.js access, including the ability to use 'require' and 'process'. This malicious code runs whenever any user on the instance triggers a query using the compromised plugin, resulting in remote code execution and a supply chain compromise of the entire ToolJet deployment.
To address this vulnerability, restrict the ability to PATCH or update plugins to instance administrators only. Additionally, scope plugins per organization by adding an 'organizationId' to the plugin entity, and remove 'require' and 'process' from the VM sandbox context, using 'isolated-vm' instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ToolJet/ToolJet/security/advisories/GHSA-jgmf-cw3v-r98x | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/ToolJet/ToolJet/security/advisories/GHSA-jgmf-cw3v-r98x | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ToolJet | <= 3.20.169-lts (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |