Windmill npm Package Vulnerability: Exploit in the Wild
An early warning has been issued regarding a high-severity vulnerability in the Windmill npm package, which allows unauthenticated path traversal to read arbitrary server files. This flaw is reportedly being actively exploited in the wild.
What happened
The vulnerability, tracked as CVE-2026-29059, impacts the 'get_log_file' endpoint in Windmill, allowing attackers to read arbitrary files on the server. The issue arises from insufficient sanitization of the 'filename' parameter, enabling directory traversal using '../' sequences. This could potentially expose sensitive information such as the SUPERADMIN_SECRET environment variable, though it is not set by default.
The flaw affects multiple versions of Windmill, from v1.463.0 to v1.603.2. The vulnerability has been addressed in Windmill 1.603.3, which includes sanitization checks to prevent directory traversal. Users are advised to upgrade to the latest version and review access controls for the affected endpoint to mitigate potential risks.
How 0Day mitigates this
windmill is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.