Vulnerabilities

TI-2026-39238 CVE-2026-54344

ToolJet GitHub Actions comment body shell injection exposes deployment secrets

HIGH 71

ToolJet is an open-source low-code platform for building internal tools.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00362 Published 2026-07-08 Fixed in 3.20.180 CWE-78

TI-2022-10832 CVE-2022-27979 · GHSA-g284-h22q-9fgj

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute…

MEDIUM 58

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-04-26 No fix listed CWE-79

TI-2022-10831 CVE-2022-27978 · GHSA-wxm6-gcq6-r4p5

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to…

HIGH 72

Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01028 Published 2023-04-26 No fix listed CWE-755

TI-2022-03759 CVE-2022-4111 · GHSA-hgp8-w8fj-r4cm

Improper Validation of Specified Quantity in Input in tooljet/tooljet

MEDIUM 62

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0082 Published 2022-11-22 Fixed in v1.27.0, 1.27.0 CWE-1284

TI-2022-03160 CVE-2022-3422 · GHSA-33ww-4588-wf76

Improper Privilege Management in tooljet/tooljet

LOW 35

Account Takeover :: when see the info i can see the hash pass i can creaked it ...............

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0101 Published 2022-10-07 Fixed in v1.26.1 CWE-269

TI-2022-03094 CVE-2022-3348 · GHSA-xr6p-m6mj-h42c

Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet

LOW 27

Just like in the previous report, an attacker could steal the account of different users.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0107 Published 2022-09-28 Fixed in v1.26.0 CWE-200

TI-2022-02784 CVE-2022-3019 · GHSA-w4fh-p39j-749c

Improper Access Control in tooljet/tooljet

MEDIUM 40

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's might also be an option but I wouldn't count on it, since it wo…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00997 Published 2022-08-29 Fixed in 1.23.0 CWE-284

TI-2022-02433 CVE-2022-2631 · GHSA-423h-352x-q557

Improper Access Control in tooljet/tooljet

MEDIUM 40

Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0119 Published 2022-08-02 Fixed in v1.19.0 CWE-284

TI-2022-01888 CVE-2022-2037 · GHSA-hj55-xwhh-6q97

Excessive Attack Surface in tooljet/tooljet

LOW 37

Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01155 Published 2022-06-09 Fixed in v1.16.0 CWE-1125

TI-2022-07241 CVE-2022-23068 · GHSA-2wqm-v6p6-8mqx

ToolJet - HTML Injection in Invite New User

LOW 25

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitatio…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00615 Published 2022-05-18 No fix listed CWE-74

TI-2022-07240 CVE-2022-23067 · GHSA-c4fh-wf5v-23wx

ToolJet - Token Leakage via Referer Header

MEDIUM 41

ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover .

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01308 Published 2022-05-18 No fix listed CWE-200

Vulnerabilities

Filters