CVE Intelligence
Analysis AI-assisted

CVE-2026-55413: ToolJet: server-side code injection via shared marketplace plugin

CVE-2026-55413 affects ToolJet versions prior to 3.20.178-lts. An authenticated user with the builder role can overwrite a globally shared marketplace plugin with JavaScript that runs server-side. The record rates it critical (CVSS 4.0 score 9.4), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

ToolJet is an open-source platform for building internal tools, workflows and AI agents. According to the GitHub Security Advisory, versions prior to 3.20.178-lts allow an authenticated builder-role user to overwrite a globally shared marketplace plugin with arbitrary JavaScript that runs server-side.

Impact

  • The advisory describes code running on the server with full Node.js access, which the record characterizes as remote code execution.
  • Because the plugin is shared across the instance, the code runs when any user triggers a query using that plugin, creating a supply-chain risk for the whole deployment.
  • The record assigns CVSS 4.0 base score 9.4 (critical), with network attack vector, low privileges required and no user interaction, and high impact on confidentiality, integrity and availability.
  • The weakness is classified as CWE-94 (Code Injection).

Affected products and versions

  • ToolJet instances prior to 3.20.178-lts, as stated in the advisory description.
  • The record does not include structured affected-product or version ranges, so the boundary is taken from the description only.

Exploitation status

The KEV field in the record shows this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade ToolJet to 3.20.178-lts or later, as stated in the advisory description.
  • Until the upgrade is complete, limit the builder role to trusted users and review who currently holds it.
  • Review the marketplace plugins installed on the instance and verify their code against known-good copies.
  • Restrict who can publish or modify shared plugins, and monitor changes to them.

Detection guidance

  • Review audit or application logs for modifications to marketplace plugins made by builder-role accounts.
  • Compare installed plugin code with trusted sources and investigate unexpected changes.
  • Watch for unusual server-side process activity originating from the ToolJet application after plugin-driven queries.
  • These are high-level suggestions; the record does not describe specific indicators of compromise.

Limitations of the available information

  • The record has no native title, structured affected or fixed version lists, or vendor patch notes beyond the description.
  • EPSS and SSVC data are absent.
  • The record does not state whether other roles or other modification paths are affected.
  • Whether prior exploitation occurred cannot be determined from the sources consulted.

Frequently asked questions

Which ToolJet versions are affected by CVE-2026-55413?

According to the advisory description in the record, versions prior to 3.20.178-lts are affected. The record does not provide structured version ranges.

What is the fixed version?

The description states the vulnerability is fixed in 3.20.178-lts. Upgrading to that version or later is the primary remediation step.

Is this CVE being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority given the critical rating.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.