HEYM · CVE-2026-67543 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Heym's skill executor runs skill Python in the backend process with only a memory limit and a short environment denylist, instead of a Docker sandbox. A malicious or shared skill can reach the filesystem, the network, and non-denylisted secrets, and with the shipped Docker config (root backend plus mounted docker.sock) it can gain root on the host.
first public Jul 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Heym deployments below 0.0.70 are exposed, especially those using the shipped Docker config where the backend runs as root with the Docker socket mounted. Deployments where only trusted users can create skills have a smaller exposure, but the sources do not say how the skill executor is reached over the network. Managed or hosted Heym instances are the vendor's responsibility.
Not affected if no-docker-socket-mount, trusted-skill-authors-only, version-0.0.70-or-later
Who cares docker, heym, python, self-hosted
0.0.70 are affected./var/run/docker.sock (for example in docker-compose.yml).0.0.70 or later.Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (python_tool_executor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skill_python_executor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.