Executive brief
ToolJet is an open-source platform used by businesses to build internal tools and AI agents. A security flaw allows any user with basic 'builder' permissions to replace legitimate system plugins with malicious code. If exploited, an attacker can take full control of the server, steal sensitive data, and compromise every user and workspace within the organization's ToolJet deployment.
Technical details
A vulnerability in ToolJet's plugin management allows an authenticated user with the 'builder' role to overwrite globally-shared marketplace plugins. The root cause is a lack of authorization boundaries on the 'PATCH /api/plugins/:id' endpoint, which fails to restrict plugin modifications to specific organizations or administrative users. An attacker can point a plugin's repository field to a malicious GitHub repository containing a crafted 'index.js' payload. When any user on the instance triggers a query using the poisoned plugin, the malicious code executes server-side via Node.js 'vm.runInNewContext()'. Because the sandbox is configured with full access to 'require' and 'process', the attacker achieves full Remote Code Execution (RCE). This issue is fixed in version 3.20.178-lts.
Affected products
- ToolJet ToolJet < 3.20.178-lts
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD