{"id":"CVE-2026-67543","kind":"vulnerability","aliases":["CVE-2026-67543"],"related":[],"title":"Heym: skill Python runs unisolated in backend, escalating to host root","description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (python_tool_executor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skill_python_executor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70.","summary":"Heym's skill executor runs skill Python in the backend process with only a memory limit and a short environment denylist, instead of a Docker sandbox. A malicious or shared skill can reach the filesystem, the network, and non-denylisted secrets, and with the shipped Docker config (root backend plus mounted docker.sock) it can gain root on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Heym","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","docker","heym","python","self-hosted"],"not_affected_if":["no-docker-socket-mount","trusted-skill-authors-only","version-0.0.70-or-later"],"how_to_check":"- Check the Heym version: versions below `0.0.70` are affected.\n- Check whether the backend container runs as root and mounts `/var/run/docker.sock` (for example in docker-compose.yml).\n- Check whether untrusted or shared users can create or run skills.","fix":"- Heym: upgrade to `0.0.70` or later.","status":"open","published_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:24+00:00","updated_at":"2026-11-11T22:31:24+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-11T22:31:24Z","model":"claude-haiku-5-5","output":{"fix":"- Heym: upgrade to `0.0.70` or later.","reach":"unknown","title":"Heym: skill Python runs unisolated in backend, escalating to host root","impact":"high","summary":"Heym's skill executor runs skill Python in the backend process with only a memory limit and a short environment denylist, instead of a Docker sandbox. A malicious or shared skill can reach the filesystem, the network, and non-denylisted secrets, and with the shipped Docker config (root backend plus mounted docker.sock) it can gain root on the host.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["heym","self-hosted","docker","python"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Skill code gains host root through the mounted Docker socket.","analyst_note":"","how_to_check":"- Check the Heym version: versions below `0.0.70` are affected.\n- Check whether the backend container runs as root and mounts `/var/run/docker.sock` (for example in docker-compose.yml).\n- Check whether untrusted or shared users can create or run skills.","plain_action":"","product_name":"Heym","needs_analyst":false,"not_affected_if":["version-0.0.70-or-later","no-docker-socket-mount","trusted-skill-authors-only"],"who_is_affected":"Self-hosted Heym deployments below 0.0.70 are exposed, especially those using the shipped Docker config where the backend runs as root with the Docker socket mounted. Deployments where only trusted users can create skills have a smaller exposure, but the sources do not say how the skill executor is reached over the network. Managed or hosted Heym instances are the vendor's responsibility.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001337,"input_tokens":4801,"output_tokens":1713,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-67543':14A,17A '/var/run/docker.sock':212C '0.0.70':107C,226C '512':166C '7':171C 'access':186C 'agent':92C 'ai':20B 'ai-tool':19B 'autom':98C 'backend':7A,37B,77B,158C,181C,208C 'build':89C 'busi':96C 'business-process':95C 'close':147C 'code':113C,126C 'config':75B,207C 'context':183C 'cve':12A,15A 'denylist':48B,68B,174C,192C 'docker':22B,52B,74B,132C,144C,162C,206C 'docker.sock':80B 'egress':188C 'env':173C 'environ':47B,193C 'escal':8A,215C 'execut':178C,182C 'executor':31B,122C,150C 'expos':199C 'fail':146C 'filesystem':62B,185C 'fs':139C 'gain':83B 'harden':109C 'heym':1A,18A,23B,28B,88C,108C 'host':10A,27B,87B,102C,217C 'infrastructur':103C 'insid':179C 'instead':49B 'isol':163C 'issu':220C 'key':172C 'limit':43B 'local':157C 'malici':55B 'mandat':130C 'mb':167C 'memori':42B 'mount':79B,213C 'network':64B,135C,187C 'non':67B,141C,191C 'non-denylist':66B,190C 'non-root':140C 'one':110C 'patch':223C 'path':114C 'plus':78B 'prior':104C 'process':38B,97C 'python':3A,24B,34B,120C,154C 'python_tool_executor.py':123C 'reach':60B 'read':137C 'read-on':136C 'rlimit':168C 'root':11A,76B,84B,142C,211C,218C 'run':4A,32B,91C,152C,209C 'sandbox':53B,133C 'secret':69B 'self':26B,101C 'self-host':25B,100C 'share':57B 'ship':73B,205C 'short':46B 'sibl':118C 'skill':2A,30B,33B,58B,149C,153C,177C,202C 'skill_python_executor.py':151C 'socket':145C 'subprocess':159C 'system':93C 'tool':21B,121C 'treat':124C 'unisol':5A 'untrust':112C,128C 'untrusted-cod':111C 'untrusted/shared':201C 'user':125C 'variabl':194C 'version':106C,225C 'via':155C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Heym deployments below 0.0.70 are exposed, especially those using the shipped Docker config where the backend runs as root with the Docker socket mounted. Deployments where only trusted users can create skills have a smaller exposure, but the sources do not say how the skill executor is reached over the network. Managed or hosted Heym instances are the vendor's responsibility.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["heym"],"ptokens":["heym"],"labels":["aitooling","docker","heym","high","python","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67543':14A,17A 'backend':7A 'cve':12A,15A 'escal':8A 'heym':1A,18A 'host':10A 'python':3A 'root':11A 'run':4A 'skill':2A 'unisol':5A","search_b":"'ai':20B 'ai-tool':19B 'backend':37B,77B 'config':75B 'denylist':48B,68B 'docker':22B,52B,74B 'docker.sock':80B 'environ':47B 'executor':31B 'filesystem':62B 'gain':83B 'heym':23B,28B 'host':27B,87B 'instead':49B 'limit':43B 'malici':55B 'memori':42B 'mount':79B 'network':64B 'non':67B 'non-denylist':66B 'plus':78B 'process':38B 'python':24B,34B 'reach':60B 'root':76B,84B 'run':32B 'sandbox':53B 'secret':69B 'self':26B 'self-host':25B 'share':57B 'ship':73B 'short':46B 'skill':30B,33B,58B 'tool':21B","search_c":"'/var/run/docker.sock':212C '0.0.70':107C,226C '512':166C '7':171C 'access':186C 'agent':92C 'autom':98C 'backend':158C,181C,208C 'build':89C 'busi':96C 'business-process':95C 'close':147C 'code':113C,126C 'config':207C 'context':183C 'denylist':174C,192C 'docker':132C,144C,162C,206C 'egress':188C 'env':173C 'environ':193C 'escal':215C 'execut':178C,182C 'executor':122C,150C 'expos':199C 'fail':146C 'filesystem':185C 'fs':139C 'harden':109C 'heym':88C,108C 'host':102C,217C 'infrastructur':103C 'insid':179C 'isol':163C 'issu':220C 'key':172C 'local':157C 'mandat':130C 'mb':167C 'mount':213C 'network':135C,187C 'non':141C,191C 'non-denylist':190C 'non-root':140C 'one':110C 'patch':223C 'path':114C 'prior':104C 'process':97C 'python':120C,154C 'python_tool_executor.py':123C 'read':137C 'read-on':136C 'rlimit':168C 'root':142C,211C,218C 'run':91C,152C,209C 'sandbox':133C 'self':101C 'self-host':100C 'ship':205C 'sibl':118C 'skill':149C,153C,177C,202C 'skill_python_executor.py':151C 'socket':145C 'subprocess':159C 'system':93C 'tool':121C 'treat':124C 'untrust':112C,128C 'untrusted-cod':111C 'untrusted/shared':201C 'user':125C 'variabl':194C 'version':106C,225C 'via':155C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-11T09:51:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67543","severity":null,"published_at":"2026-11-11T22:17:28+00:00","modified_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129442,"url":"https://github.com/heymrun/heym/commit/2155057f4153a1e3a7b789d104f7fa96e92964e5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129443,"url":"https://github.com/heymrun/heym/commit/28bb2901e4dea128ac493f67ee9478d230b7a3d7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129432,"url":"https://github.com/heymrun/heym/releases/tag/0.0.70","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129445,"url":"https://github.com/heymrun/heym/security/advisories/GHSA-hcv7-mg77-pg73","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-11T09:51:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}