CVE-2026-55376

Deferred Deferred - Pending Action

Python Tool Sandbox Escape in Heym

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55376

EUVD

EUVD-2026-98740

Affected Vendors & Products

Vendor	Product	Version / Range
heymrun	heym	< 0.0.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-55376 is a high-severity vulnerability in Heym's Python tool sandbox. It allows authenticated users who can create or edit workflows with custom Python tools to bypass the sandbox's blacklist and execute arbitrary operating system commands or perform file read/write operations on the backend host. The issue occurs because allowed standard-library modules expose dangerous capabilities through public attributes, such as glob.os.system(), which bypasses the blacklist-based sandbox in python_tool_executor.py.

The vulnerability was fixed in version 0.0.40 by running Python tools in a hardened, isolated container by default, preventing sandbox escapes.

Detection Guidance

Check Heym version with: pip show heym or heym --version. If version is below 0.0.40, the system is vulnerable. Inspect python_tool_executor.py for blacklist-based sandboxing. Look for suspicious workflows using modules like glob.os.system or shutil for OS command execution.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the backend host, potentially leading to full system compromise. Attackers could read, modify, or delete sensitive files, install malware, or take control of the system. Since the default configuration allows self-registration, unauthenticated users might gain access in some deployments, increasing the risk of exploitation.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data, leading to data breaches. It compromises confidentiality, integrity, and availability of systems, potentially resulting in legal penalties, reputational damage, and loss of trust. The high CVSS score reflects the significant impact on these compliance requirements.

Mitigation Strategies

Upgrade Heym to version 0.0.40 or later immediately. Disable self-registration if enabled (ALLOW_REGISTER=false). Restrict user permissions to prevent workflow creation/editing. Monitor for unauthorized file operations or command executions in logs.

Hi! I’m here to help you understand CVE-2026-55376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70