CVE-2026-67543: Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (pythontoolexecutor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skillpythonexecutor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Which deployments are most exposed to host compromise?
The shipped Docker configuration is especially exposed because the backend runs as root and mounts /var/run/docker.sock. A malicious skill can use the backend execution context to escalate to host root in that configuration.
What level of access does an attacker need to exploit this issue?
An attacker needs the ability to cause an untrusted or shared skill to be executed. The vulnerable skill executor runs that skill's Python code in a local backend subprocess rather than in the Docker sandbox required for Python tools.
What can a malicious skill access before the fix?
It can access the backend filesystem, make outbound network connections, and read environment variables not covered by the seven-key denylist. Its only stated resource restriction is a 512 MB RLIMIT.
How can I determine whether my deployment is affected?
Deployments running a Heym version earlier than 0.0.70 are affected. Review whether skill execution is enabled and whether the backend container runs as root or has /var/run/docker.sock mounted, as these conditions increase impact.
What should be done if an immediate upgrade is not possible?
Do not execute untrusted or shared skills until the deployment can be updated to version 0.0.70. Restricting skill execution reduces exposure to code running with backend filesystem, network, and environment access.