Heym: Sandbox escape in Agent Python tool allows command execution
Summary
Heym, a self-hosted platform for agentic systems and workflow automation, contains a sandbox escape in its custom Python tools. An authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox and run commands and file operations as the backend application user. Self-registration affects reachability, but a user who only triggers a portal does not gain code control.
Affected
- Heym up to and including 0.0.39 (advisory lists affected versions below 0.0.40)
Fixed in
- Heym 0.0.40 or later
Workaround
- No official workaround published by the vendor. Upgrading to 0.0.40 is the fix.
- Interim measure (recommendation, not from the vendor): restrict who can create or edit workflows with custom Python tools and remove untrusted editor accounts.
Exploitation
- CISA SSVC: Exploitation "poc", Automatable "no", Technical Impact "total".
- The reporter provided a proof of concept privately during disclosure; no public PoC or exploit publication was found.
- No evidence of exploitation in the wild; not listed as known exploited in the sources checked.
Our recommendation
- Inventory all Heym instances and check for versions below 0.0.40.
- Upgrade to Heym 0.0.40 or later.
- Until upgraded, restrict workflow create and edit rights and review existing workflows for unexpected Python tools.
- Check whether instances are internet-facing and whether self-registration is enabled; prioritise internet-facing instances.
- Review backend logs and host activity for unexpected child processes or file changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wcgw-9hfw-f6f2 github.com
- Heym release v0.0.40 github.com
- Fix commit b36d795 github.com
- VulDB entry 417753 vuldb.com
- OSV entry CVE-2026-55376 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:07.
Original description (NVD)
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py because allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), permitting commands and file operations as the backend application user; self-registration affects reachability, but portal triggering alone does not grant code control. This issue is fixed in 0.0.40.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.