{"data":{"id":"e524599b-d495-481e-84d2-9521dd222891","title":"CVE-2026-55413: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI…","summary":"ToolJet, an open-source platform for building internal tools, workflows and AI agents, is affected by CVE-2026-55413 in versions before 3.20.178-lts. Any authenticated user with the builder role, including on the free tier, can overwrite a globally shared marketplace plugin with arbitrary JavaScript. That code runs server-side with full Node.js access whenever any user on the instance triggers a query using the plugin, enabling remote code execution and supply-chain compromise of the deployment.","solution":"Fixed in 3.20.178-lts.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55413","publishedAt":"2026-06-25T17:16:42.200Z","cveId":"CVE-2026-55413","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ToolJet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ToolJet marketplace plugin overwrite allows server-side code execution","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00318,"epssCheckedAt":"2026-11-09T06:13:52.357Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-10T00:11:42.415Z","patchAvailable":null,"disclosureDate":"2026-06-25T17:16:42.200Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}