CVE-2026-55376: Heym Workflow Agent Python Sandbox Bypass RCE

CVE-2026-55376 Overview

CVE-2026-55376 affects Heym, a platform for building and running agentic systems and business-process automations on self-hosted infrastructure. The vulnerability lets an authenticated user who can create or edit a workflow with an Agent custom Python tool bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py. Allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(). The runner then executes the supplied tool with exec(), running commands and file operations as the backend application user. The issue is fixed in version 0.0.40 and is classified under [CWE-78] OS Command Injection.

Critical Impact

Authenticated workflow authors can execute arbitrary commands and file operations as the backend application user, leading to full host compromise where the Heym backend runs.

Affected Products

• Heym agentic automation platform (self-hosted)
• Heym versions prior to 0.0.40
• Deployments exposing workflow authoring to multiple users or self-registration

Discovery Timeline

• 2026-10-13 - CVE-2026-55376 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-55376

Vulnerability Analysis

Heym exposes an Agent custom Python tool that lets workflow authors supply Python code to be executed by the backend. The executor at backend/app/services/python_tool_executor.py applies a blacklist-based sandbox implemented through _safe_import() and _validate_code_safety(). The sandbox rejects known-dangerous modules and syntactic patterns, then runs the remaining code through Python's built-in exec().

The design assumes that modules outside the blacklist cannot reach operating-system, process, or filesystem primitives. That assumption fails because several permitted standard-library modules re-expose those capabilities through public attributes. An authenticated user who can create or edit a workflow can therefore craft tool code that resolves to shell execution, process control, or arbitrary file I/O without triggering the validator.

Because the executed code runs under the backend application user, successful exploitation yields command execution on the host and access to any secrets, databases, or network resources available to that process.

Root Cause

The root cause is reliance on a blacklist sandbox around a Python exec() call. Blacklists cannot reliably contain Python's dynamic attribute lookup, import machinery, and object graph. Standard-library modules that pass the import filter still provide indirect paths to os, subprocess, and file operations. The validator inspects the submitted source without constraining the runtime capabilities of imported modules.

Attack Vector

The attack requires network access to the Heym portal and an authenticated account with workflow create or edit permissions. The attacker defines an Agent workflow that uses the custom Python tool, submits code that imports permitted modules, and reaches operating-system functionality through their public attributes. Triggering the workflow invokes the executor, which calls exec() on the attacker-controlled source and runs it as the backend user. The advisory notes that self-registration affects reachability, while portal triggering alone without authoring rights does not grant code control.

Technical details are available in the GitHub Security Advisory GHSA-wcgw-9hfw-f6f2 and the fix commit.

Detection Methods for CVE-2026-55376

Indicators of Compromise

• Unexpected child processes spawned by the Heym backend Python process, such as /bin/sh, bash, curl, wget, or python subprocesses.
• Workflow definitions containing Agent custom Python tool code that imports standard-library modules and accesses attributes that resolve to os, subprocess, or file I/O.
• New or modified files in the backend application user's writable paths that do not correspond to legitimate workflow artifacts.
• Outbound network connections from the Heym backend to untrusted hosts following workflow execution.

Detection Strategies

• Audit the workflow database for custom Python tool content and flag code that references attribute chains leading to OS or subprocess functionality.
• Enable process-ancestry telemetry on hosts running the Heym backend to correlate child process executions with workflow invocations.
• Alert on write operations to sensitive paths performed by the backend service account.

Monitoring Recommendations

• Forward Heym application logs, workflow execution events, and host process telemetry to a centralized analytics pipeline for correlation.
• Baseline normal process and network behavior of the Heym backend and alert on deviations after workflow runs.
• Track creation and modification of Agent custom Python tools, especially by newly registered accounts.

How to Mitigate CVE-2026-55376

Immediate Actions Required

• Upgrade Heym to version 0.0.40 or later, which contains the fix.
• Disable self-registration on the Heym portal until the upgrade is complete to reduce the attacker population.
• Audit existing workflows for Agent custom Python tool code and remove or review any entries created by untrusted users.
• Rotate credentials, API keys, and tokens accessible to the Heym backend application user if exploitation is suspected.

Patch Information

The vendor fixed the issue in Heym 0.0.40. See the GitHub Release v0.0.40 notes and the fix commit for the specific changes to backend/app/services/python_tool_executor.py.

Workarounds

• Restrict workflow create and edit permissions to a small group of trusted administrators until patching.
• Run the Heym backend as an unprivileged, isolated service account with no access to secrets, databases, or network paths beyond what the application requires.
• Deploy the Heym backend inside a container or sandbox with seccomp, AppArmor, or SELinux profiles that block process execution and sensitive file writes.
• Network-segment the Heym host to prevent lateral movement if the backend process is compromised.

# Example: upgrade and restart Heym to apply the fix
pip install --upgrade heym==0.0.40
systemctl restart heym-backend