Remote Code Execution Flaw in BISHENG Software by DataElement
CVE-2026-82278

8.7HIGH

Key Information:

Vendor

Dataelement

Status
Bisheng
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82278?

BISHENG versions prior to 2.6.0 expose a critical vulnerability in the workflow run_once API endpoint that allows authenticated users to execute arbitrary Python code. This flaw enables attackers to submit specially crafted Code node definitions, which are processed and executed through the exec() method without any form of sandboxing. As a result, unauthorized access to the file system, user credentials, and internal networking resources may be achieved, posing significant risks to system integrity and security.

Affected Version(s)

bisheng 0 < 2.6.0

References

https://github.com/dataelement/bisheng/issues/2189
issue-tracking
https://github.com/dataelement/bisheng
product
https://github.com/dataelement/bisheng/blob/v2.4.0/src/ba...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.