Coze Studio EUVD-2026-104690

Requires (1) an authenticated account - any registered user suffices per PR:L, with no admin role needed - and (2) the vulnerable default configuration CODE_RUNNER_TYPE="local" (shipped default in docker/.env.example before 0.5.0), which runs workflow code nodes in an unsandboxed python3 subprocess on the host. The attacker must be able to create/run a workflow code node, and the regex import filter is defeated using __import__('subprocess'). Exploitation is LIMITED by the authentication requirement and by deployments that have changed the runner to "sandbox" (the patched default) or otherwise isolated the code runner; instances running the fixed default or without the local runner enabled are not exploitable via this path. No user interaction is required (UI:N).

This is a credible, high-priority risk for any organization running a self-hosted Coze Studio instance prior to 0.5.0. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H scores 8.7 and is consistent with the description: a network-reachable, low-complexity attack requiring only low privileges (PR:L = any registered user) and no user interaction, yielding full confidentiality, integrity and availability impact via arbitrary command execution. Publicly available exploit code exists (Lasso Security), which materially raises near-term risk, but this must NOT be conflated with active exploitation - the CVE is not listed in CISA KEV and no EPSS probability was provided in the input, so widespread opportunistic exploitation cannot be confirmed from available data. The root cause is an insecure default (CWE-1188): the shipped CODE_RUNNER_TYPE="local" setting runs workflow code nodes in an unsandboxed python3 subprocess, and the regex-based import filter is trivially bypassed via __import__('subprocess'). The main mitigating factor is that exploitation requires an authenticated account on the instance and the default (unpatched) local runner configuration; it is not a pre-auth internet-wide worm candidate. Net assessment: a genuine priority for exposed/multi-tenant deployments, somewhat tempered by the authentication requirement and the product's limited production footprint rather than being a high-CVSS-but-low-real-risk issue.

An attacker who registers (or already holds) a low-privileged account on a default-configured Coze Studio instance builds a workflow containing a python code node and bypasses the import filter with __import__('subprocess') to run OS commands in the unsandboxed runner. From there they read environment variables and model API keys and pivot to the backing MySQL, MinIO, Redis and etcd services. A public proof-of-concept exists, and the network/low-complexity vector makes exploitation straightforward once an account is obtained.