{"id":"CVE-2026-55376","published":"2026-10-13T16:17:21.720","lastModified":"2026-10-16T22:17:23.847","description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78","CWE-94","CWE-693"],"vendors":[],"products":[],"references":[{"url":"https://github.com/heymrun/heym/commit/b36d795c6ea841b8f1b511a0952e274487ee4ef3","tags":[]},{"url":"https://github.com/heymrun/heym/releases/tag/v0.0.40","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2","tags":[]}],"exploitRefs":[{"url":"https://github.com/heymrun/heym/commit/b36d795c6ea841b8f1b511a0952e274487ee4ef3","tags":[]},{"url":"https://github.com/heymrun/heym/releases/tag/v0.0.40","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user can bypass Python sandboxing in Heym's workflow tools by using standard library modules that expose OS, process, and filesystem capabilities through public attributes. This allows attackers to execute arbitrary commands and access files as the backend application user.","exploitability":"Exploitation requires an authenticated user with workflow creation/editing privileges who can add a custom Python tool; it's moderately difficult due to the need for crafting a specific payload that leverages standard library attributes, but the sandbox bypass is straightforward once achieved.","blast_radius":"The impact could be significant as attackers can execute arbitrary code and access files as the backend application user, potentially leading to full system compromise if the backend has elevated privileges or access to sensitive data.","remediation":"Upgrade to version 0.0.40 or later to fix the Python sandboxing bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sandbox-bypass","python"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:49:44.879Z"}}