H3-2026-1127¶
Windmill Unauthenticated Remote Code Execution via Execute Component Module Injection
| Category | VULNERABILITY |
| Base Score | 10.0 |
Description¶
The unauthenticated execute_component endpoint in Windmill pins only the raw_code.content field by SHA256 hash but forwards caller supplied lock, modules, hash, path, and dedicated_worker fields to the job verbatim. Remote attackers can inject a malicious init.py module through the raw_code.modules field that hijacks the subprocess.run import inside the pinned script at execution time. The hijacked import redirects the script's own subprocess calls to execute attacker controlled commands under the identity of the app owner. Exploitation requires an anonymous mode application already present in the target Windmill workspace, reachable through the execute_component API.
Impact¶
Attackers gain remote code execution as the identity of the Windmill app owner without any credentials. This can lead to exfiltration of secrets and variables stored in the workspace, lateral movement to connected resources, and compromise of scheduled jobs. Organizations running Windmill as a workflow automation or internal tooling platform face direct exposure. The flaw affects any workspace with an existing anonymous mode application reachable from the network.