Back Feeds2.Feedburner

Zapier exploit chain shows how known anti

Feeds2.Feedburner •Mirko Zorz • May 28, 2026

A five-stage exploit chain disclosed by Token Security researchers turned a free Zapier account into write access on Zapier’s public developer SDK packages and on internal packages that load in every authenticated zapier.com session. Each link in the chain was a known anti-pattern. The composition across five systems was the finding. Zapier triaged the report within four days of submission on February 12, 2026, revoked the leaked NPM token, and tightened the underlying AWS role … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zapier Exploit Chain Grants Unauthorized NPM Access Researchers at Token Security disclosed a five-stage exploit chain that allowed a free Zapier account to gain write access to both public and internal NPM packages. Each stage of the chain exploited known anti-patterns, culminating in a significant security vulnerability. The attack vector involved a sandbox escape within Zapier's Code by Zapier feature, which executes user-supplied Python and JavaScript in AWS Lambda containers. The vulnerability was reported on February 12, 2026, and was triaged by Zapier within four days, leading to the revocation of a leaked NPM token and tightening of AWS roles. The incident highlights the risks associated with supply chain vulnerabilities in widely used developer tools. No specific CVEs were disclosed in the articles. The current status indicates that the vulnerability has been addressed by Zapier. 6 sources 58

Zapier exploit chain shows how known anti

The full story

Extracted Entities

Companies (3)

Domains (1)