Read the docs
TI-2026-39238 Aliases CVE-2026-54344

ToolJet GitHub Actions comment body shell injection exposes deployment secrets

Priority HIGH 71CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a deploy command to execute shell commands on the CI runner and exfiltrate deployment secrets. This issue is reported as fixed in version 3.20.180.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00362 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ToolJet (ToolJet): 3.20.180

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ToolJetToolJetbefore 3.20.1803.20.180Patch availableCNA
  • ToolJet VendorToolJet Affected before 3.20.180 Fixed in 3.20.180 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*before 3.20.180VulnerableToolJet
  • cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:* Versions before 3.20.180 Vulnerable ·ToolJet

Remediation

  • Fix · CNA ToolJet (ToolJet) Fixed in 3.20.180

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54344

References

Exploit 1

  • TI-2022-10831 Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to… CVSS 3.1HIGH 7.5
  • TI-2022-03759 Improper Validation of Specified Quantity in Input in tooljet/tooljet CVSS 3.1MEDIUM 6.5
  • TI-2022-10832 A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute… CVSS 3.1MEDIUM 5.4
  • TI-2022-07240 ToolJet - Token Leakage via Referer Header CVSS 3.1HIGH 8.8
  • TI-2022-02784 Improper Access Control in tooljet/tooljet CVSS 3.1HIGH 8.8
  • TI-2022-02433 Improper Access Control in tooljet/tooljet CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences