Expression Injection Vulnerability in Mendix Applications

An attacker with valid application access could inject expressions into Mendix Workflow logic to extract sensitive data from your application memory or backend systems. This could expose database credentials, user information, or other confidential data depending on what your application stores.

Organizations running Mendix applications for business logic, reporting, or workflow automation should prioritize this update. This includes line-of-business applications, asset management systems, and any Mendix-based tools handling sensitive data or credentials. Developers using the Mendix Workflow feature for process automation are most directly affected.

An attacker with legitimate user or developer access to a Mendix application using the Workflow visual language could craft malicious expression payloads in workflow inputs or configurations. These injected expressions are processed by the Mendix Runtime without proper sanitization, allowing the attacker to execute arbitrary code and access sensitive data stored in the application context or connected systems.