Heym CVE-2026-45227

Exploitation requires an authenticated Heym account with permission to author or edit custom Python tools/workflows (CVSS PR:L) on a version before 0.0.21; the attacker must be able to submit and execute Python code through the tool executor feature. No user interaction from a victim is needed (UI:N) and the vector is network-reachable (AV:N) via the normal workflow interface. Limiting factors: the attacker cannot be fully anonymous - they need valid author-level credentials - so instances that restrict Python-tool authoring to trusted operators are not exposed to arbitrary users; impact is also gated to whatever secrets and privileges the backend service user holds, so a hardened, least-privilege service account reduces the payoff. Value of the exploit further depends on sensitive material (DB credentials, encryption keys) actually being present in the backend process environment.

Signals are mixed and point to a real-but-not-mass-exploitation profile. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H, base 8.7) and SSVC 'Technical Impact: total' confirm severe consequences - full host command execution and credential theft - but require authenticated access (PR:L, a workflow author account), which sharply narrows the attacker population. SSVC 'Automatable: no' and the very low EPSS (0.04%, 14th percentile) indicate this is not being sprayed at scale; it is a post-authentication privilege/containment breach rather than a drive-by internet exploit. A public POC exists per SSVC, raising practical exploitability for anyone who already has author access, but there is no KEV listing and no evidence of active exploitation. Net: high priority for any organization running Heym that grants Python-tool authoring to semi-trusted users, but lower urgency where workflow authoring is restricted to fully trusted operators. No major data conflicts - the network vector is consistent with a web-based workflow platform, and the PR:L requirement is consistent with the 'authenticated workflow authors' language in the description.

An attacker who has (or phishes/registers) a workflow-author account in a Heym instance creates a custom Python tool whose code walks the interpreter's object graph to recover __import__, then imports os and subprocess. Running that workflow yields arbitrary shell command execution as the backend service user and lets the attacker read environment variables containing database credentials and encryption keys, pivoting to the database and stored secrets. A public POC for this introspection technique already exists per the SSVC assessment, lowering the skill required.