GHSA-hcv7-mg77-pg73: Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (pythontoolexecutor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skillpythonexecutor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running Heym versions before 0.0.70 are exposed when untrusted or shared skills can be executed. Skill code runs in the backend execution context rather than in the Docker sandbox used for Python tools.
What access does an attacker need to exploit it?
An attacker needs the ability to cause a Python skill to run. No user interaction is required after the skill is executed.
What can an unsandboxed skill access?
The skill can access the backend filesystem, make network connections, and read environment variables except for the seven denylisted keys. The 512 MB resource limit does not provide Docker isolation.
Are default container deployments at greater risk?
Yes. In the shipped Docker configuration, the backend runs as root and has the Docker socket mounted; successful skill execution can therefore escalate to root on the host.
What is the remediation?
Upgrade to Heym 0.0.70 or later. If upgrading is not immediately possible, do not execute untrusted or shared skills and avoid running the backend as root or mounting /var/run/docker.sock into it.