Coze Studio: Remote code execution via unsandboxed Python code runner

Summary

Coze Studio before 0.5.0 runs workflow code nodes as Python on the server with a local runner that is not sandboxed. Any registered user can run operating system commands by bypassing the keyword-based import filter. An attacker could read environment variables, model API keys and data from co-located MySQL, MinIO, Redis and etcd services that use default credentials.

Affected

• coze-dev Coze Studio, all versions before 0.5.0 (CVE record)
• VulDB lists the affected range as up to 0.4.x
• Deployments started with the default make or make debug targets, which set CODE_RUNNER_TYPE=local

Fixed in

• Upgrade to 0.5.0 or later. The CVE references fix commit fcf40d1, which changes the default CODE_RUNNER_TYPE from local to sandbox. The commit content could not be verified.
• Conflict: a third-party review reports that the latest published image was 0.5.1 and that the sandbox default was not in any release. Do not assume the fix is active; verify the setting after upgrading.

Workaround

• Set CODE_RUNNER_TYPE=sandbox explicitly and never use local.
• Close public registration and limit who can create accounts.
• Change the default credentials of MySQL, Redis, MinIO and etcd and do not expose their ports.
• Isolate the Coze host from the data stores on the network.

Exploitation

• CISA SSVC lists exploitation as 'poc' (a proof of concept is known) and automatable as 'no'.
• No evidence of active exploitation in the wild was found.
• Public proof-of-concept code could not be confirmed; sources disagree.

Our recommendation

• Inventory all Coze Studio instances and their versions.
• Upgrade to 0.5.0 or later and explicitly set CODE_RUNNER_TYPE=sandbox.
• Rotate credentials and API keys for co-located services and model providers.
• Restrict registration to trusted users and monitor workflow execution and outbound connections.
• Prioritise public deployments and instances that used the default make targets.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Lasso vulnerability database www.lasso.security
• Fix commit fcf40d1 github.com
• docker/.env.example at ffec252 github.com
• VulDB entry vuldb.com
• OpenCVE app.opencve.io
• Greenlit field notes greenlitbooks.com
• Coze Studio releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:37.