Read the docs
TI-2026-71768 Aliases CVE-2026-55376

Sandbox escape in heym Python tool allows command execution

Priority HIGH 73CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693 and CWE-78.

Summary

Heym before 0.0.40 contains a sandbox escape in its Python tool executor, a protection mechanism failure (CWE-693). The blacklist-based sandbox fails because allowed standard-library modules expose operating-system and filesystem capabilities through public attributes. An authenticated user who can create or edit a workflow with an Agent custom Python tool can run commands and file operations as the backend application user over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00459 39th percentileScored 2026-11-07
Fix Fixed heym (heymrun): 0.0.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heymrunheymbefore 0.0.400.0.40Patch availableCNA
  • heym Vendorheymrun Affected before 0.0.40 Fixed in 0.0.40 Patch available CNA

Remediation

Upgrade heym to 0.0.40, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA heym (heymrun) Fixed in 0.0.40

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-55376
  2. 2026-10-14 Priority changed: MEDIUM → LOW
  3. 2026-10-18 CISA SSVC decision points changed
  4. 2026-10-18 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-65003 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CVSS 4.0HIGH 8.7
  • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression Engine CVSS 4.0HIGH 8.7
  • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python Introspection CVSS 4.0HIGH 8.7
  • TI-2026-65083 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CVSS 4.0HIGH 8.3
  • TI-2026-65082 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CVSS 4.0HIGH 8.3
  • TI-2026-64996 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes CVSS 4.0HIGH 7.6
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences