CVE-2026-45227
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Heym < 0.0.21 Sandbox Escape via Python Introspection
Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
heym
- Vendor
- heymrun
- Product
- heym
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | semver | 0.0.21 | Unavailable | None listed |
| 32b7e809d987d9b018ec8daa2cdaf48f627f26f1 | unaffected | git | Unavailable | Unavailable | None listed |