Which versions of Heym are affected by CVE-2026-45227?

Heym's Python tool executor (versions before 0.0.21) contains a sandbox escape that allows authenticated workflow authors to execute arbitrary commands as the backend service user, gaining access to…. A patch is available.

How to fix or mitigate CVE-2026-45227?

Within 24 hours, identify all systems running Heym versions before 0.0.21 and verify that workflow author access is restricted to trusted personnel only. Within 7 days, apply the vendor-released patch by upgrading all affected systems to Heym 0.0.21 or later. Within 30 days, audit the workflow execution history for suspicious activity, rotate all database credentials and encryption keys as a precautionary measure, and document the full incident response timeline.

Heym CVE-2026-45227

Q: What is the CVSS score of CVE-2026-45227?

CVE-2026-45227 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29869 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-12 VulnCheck

GHSA-vhhj-j98h-xx8p

Authentication Bypass Python Heym

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable workflow feature (AV:N/AC:L) but requires an authenticated author account (PR:L); sandbox escape yields full host command execution and secret theft (C:H/I:H/A:H), same authority so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 19:16 vuln.today

Analysis Generated

Jul 23, 2026 - 19:16 vuln.today

CVSS changed

May 12, 2026 - 22:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

May 12, 2026 - 21:18 nvd

HIGH 8.7

DescriptionCVE.org

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.

AnalysisAI

Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to break out of the restricted execution environment using Python object-graph introspection, recover the unrestricted __import__ function, and load blocked modules such as os and subprocess. Once free of the sandbox, an attacker executes arbitrary host commands as the backend service user and reads inherited environment variables holding database credentials and encryption keys. Publicly available exploit code exists (SSVC 'poc'), though the EPSS probability is very low at 0.04% and it is not listed in CISA KEV.

Technical ContextAI

Heym exposes a feature that lets workflow authors write custom Python 'tools' that run inside a restricted interpreter sandbox. The vulnerability is a classic Python sandbox-escape pattern: even when dangerous builtins like __import__ are removed from the namespace, an attacker can walk the object graph - for example via ().__class__.__bases__[0].__subclasses__() or accessing __globals__/__builtins__ on reachable functions - to re-obtain the real __import__ and pull in os and subprocess. This maps to CWE-693 (Protection Mechanism Failure): the sandbox is the intended protection control, and introspection primitives defeat it rather than exploiting a memory-safety bug. The single affected package per CPE is cpe:2.3:a:heymrun:heym, a workflow/automation tool where user-authored Python is a core capability, so the blast radius is the backend service process and every secret exposed to its environment.

RemediationAI

Vendor-released patch: upgrade to Heym 0.0.21 or later, which hardens the Python tool sandbox via PR #94 (commit 32b7e809d987d9b018ec8daa2cdaf48f627f26f1); see https://github.com/heymrun/heym/releases/tag/v0.0.21. Until you can upgrade, restrict who can author or edit custom Python tools and workflows to a small set of fully trusted operators, since exploitation requires an authenticated author account - this reduces functionality for less-trusted users but directly removes the attacker population. Additionally, minimize secrets inherited by the backend service process: move database credentials and encryption keys out of the service's environment variables into a scoped secrets manager or per-request injection so a sandbox escape yields fewer usable secrets, at the cost of some configuration overhead. If feasible, run the tool executor under a dedicated low-privilege service account with a locked-down filesystem and network egress rules to limit what recovered os/subprocess access can reach. Note that v0.0.21 also bundles unrelated security fixes for stored upload path containment (PR #92) and subworkflow access checks (PR #93), so upgrading addresses multiple issues at once.