Description

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T20:20:18.923Z",
  "pubdate": "2026-08-28T20:20:18.923Z",
  "executiveSummary": "BISHENG versions prior to 2.6.0 are susceptible to a critical Remote Code Execution (RCE) vulnerability within the workflow engine.\nThe vulnerability resides in the /api/v1/workflow/run_once endpoint, which fails to properly sanitize user-supplied Code node definitions.\nAuthenticated attackers can leverage this flaw to execute arbitrary Python code directly on the host server.\nSuccessful exploitation grants an attacker full control over the application environment, potentially leading to unauthorized access to the filesystem, sensitive credentials, and internal network resources.\nThis vulnerability presents a high-risk scenario for organizations utilizing BISHENG, as it allows for trivial escalation from a standard authenticated user to remote code execution.\nThe exploitation requirement is limited to active authentication; no administrative privileges are explicitly required beyond access to the workflow execution functionality.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe implementation of the `exec()` function within the BISHENG workflow execution logic, specifically tied to the processing of Code nodes.\nThe application exposes the /api/v1/workflow/run_once endpoint, which is designed to execute workflow nodes on-demand. When a user submits a crafted Code node definition, the backend receives the payload and passes it directly to the Python interpreter's `exec()` environment without implementing any form of sandboxing, containerization, or input validation.\nExploitation follows a specific attack flow: First, an authenticated attacker crafts a malicious JSON payload containing Python code injected into the 'code' parameter of the node definition. Second, the attacker sends a POST request to the /api/v1/workflow/run_once endpoint containing this payload.\nUpon receipt, the application processes the workflow request and triggers the execution of the injected code segment through the unsanitized `exec()` call. Because the code runs within the context of the application's process, it inherits the permissions of the BISHENG service account.\nThis allows the attacker to perform a wide range of unauthorized activities, including traversing the filesystem to extract configuration files, environment variables, or database credentials. Furthermore, as the code executes on the application host, the attacker can leverage the server as a pivot point to conduct internal network reconnaissance or attack other services within the infrastructure that are not otherwise exposed to the public internet.\nThe vulnerability affects all BISHENG versions before 2.6.0. The lack of an isolated execution environment, such as a restricted Python sandbox (e.g., Pyodide or a hardened container) or a policy-based execution engine, facilitates the direct execution of malicious Python instructions, rendering traditional perimeter security controls insufficient once authentication is bypassed or obtained."
}