CVE-2026-77934: Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coze Studioto a version that resolves this vulnerability.Fixed in 0.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any registered Coze Studio user can exploit it by creating or running a workflow code node. No additional privileges or user interaction are required.
Are default deployments affected?
Yes. The issue is described as an insecure default configuration in versions before 0.5.0, where Python workflow code runs in an unsandboxed python3 subprocess.
What does an attacker need to do to execute commands?
The attacker needs access to a registered account and the ability to run workflow code nodes. They can bypass the regex-based import filter using __import__('subprocess') to invoke operating-system commands.
What could an attacker access after exploitation?
Command execution can expose environment variables and model API keys, and may provide access to services reachable from the deployment, including MySQL, MinIO, Redis, and etcd.