CVE-2026-55376: heym Python Tool Sandbox Escape
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass safeimport() and validatecodesafety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.0.40
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be able to create or edit a workflow containing an Agent custom Python tool. Merely being able to trigger workflows through the portal does not provide control over the Python code.
What access does successful exploitation provide?
The attacker can execute commands and perform file operations as the backend application user. The impact therefore depends on the permissions and accessible resources assigned to that backend user.
Are installations affected by default?
Exposure depends on whether users can create or edit workflows with Agent custom Python tools. Self-registration can affect whether an attacker can obtain an account, but it is not required if a user already has the necessary authenticated workflow-editing permissions.
What version fixes the issue?
The issue is fixed in Heym version 0.0.40. Versions prior to 0.0.40 are affected when the required workflow-editing capability is available.
What can be done if upgrading is not immediately possible?
Restrict creation and editing of workflows that use Agent custom Python tools to trusted administrators. Also limit the backend application user's operating-system, process, and filesystem permissions to reduce the impact of code execution.