CVE-2026-55376 Details
Description
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.
A vulnerability exists in Heym's Python tool execution sandbox, prior to version 0.0.40, allowing authenticated users to execute OS commands and manipulate files on the backend server. This issue arises from a blacklist-based sandboxing approach that fails to adequately restrict access to dangerous standard-library modules. The vulnerability can be exploited by users who create or edit workflows with custom Python tools, as the execution environment does not effectively prevent access to OS, process, and filesystem capabilities. The problem is particularly concerning in shared Heym instances, where it could lead to significant security breaches.
Users can update to Heym version 0.0.40 or later, where this vulnerability has been fixed. The update ensures that Python tools are executed in a secure, isolated environment by default, preventing unauthorized access to the backend host.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/heymrun/heym/commit/b36d795c6ea841b8f1b511a0952e274487ee4ef3 | [email protected] | Source CodeVendor |
| https://github.com/heymrun/heym/releases/tag/v0.0.40 | [email protected] | Release NotesVendor |
| https://github.com/heymrun/heym/security/advisories/GHSA-wcgw-9hfw-f6f2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Heym | <= 0.0.39 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |