build1 publisher
Conductor OSS runs a stranger's inline JavaScript as root in its default container
An unauthenticated POST to the Conductor Workflow API registers a definition whose inline expression evaluates in a GraalVM context with host access enabled, and the default image runs that process as root. Empirical Security logged attempts in August.
Publishers:dev.to
Reality
- Evidence58
- Adoption34
- Hype gap+14
- Incentives62
- Confidence46