{"id":"CVE-2026-67544","kind":"vulnerability","aliases":["CVE-2026-67544"],"related":[],"title":"Heym: authenticated users run arbitrary Python on backend via Playwright node","description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user — including a freshly registered account — can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71.","summary":"Heym is a self-hosted platform for building agentic systems and automations. Its workflow engine runs Python code taken unchecked from a Playwright node's field, so any logged-in user can execute commands on the backend host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentic-workflows","ai-tooling","docker","heym","playwright","self-hosted"],"not_affected_if":["no-user-registration","version-0.0.71-or-later"],"how_to_check":"- Confirm the deployed Heym version is below `0.0.71`.\n- Check whether user self-registration is enabled on your instance, since the report says a freshly registered account is enough.\n- Check which user the Heym backend process runs as; the report observed `root` in the default Docker deployment.","fix":"- Upgrade Heym to `0.0.71` or later.","status":"open","published_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:22+00:00","updated_at":"2026-11-11T22:31:22+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-11T22:31:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Heym to `0.0.71` or later.","reach":"unknown","title":"Heym: authenticated users run arbitrary Python on backend via Playwright node","impact":"high","summary":"Heym is a self-hosted platform for building agentic systems and automations. Its workflow engine runs Python code taken unchecked from a Playwright node's field, so any logged-in user can execute commands on the backend host.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["heym","self-hosted","docker","agentic-workflows","playwright"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the backend service user, reportedly root","analyst_note":"","how_to_check":"- Confirm the deployed Heym version is below `0.0.71`.\n- Check whether user self-registration is enabled on your instance, since the report says a freshly registered account is enough.\n- Check which user the Heym backend process runs as; the report observed `root` in the default Docker deployment.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.0.71-or-later","no-user-registration"],"who_is_affected":"Teams that self-host Heym and let users log in to build workflows with Playwright nodes are exposed. Any authenticated account, including a newly registered one, can reach the vulnerable path, and the backend process reportedly runs as root in the default Docker setup. Hosted or managed Heym instances are the vendor's responsibility, and the report does not say whether they are patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001308,"input_tokens":4705,"output_tokens":1676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-67544':14A,17A '0.0.71':89C,177C 'accept':94C 'account':144C 'achiev':146C 'agent':19B,39B,74C 'agentic-workflow':18B 'ai':22B 'ai-tool':21B 'arbitrari':5A,96C 'ast':132C 'authent':2A,138C 'autom':42B,80C 'backend':8A,68B,122C,154C 'build':38B,71C 'busi':78C 'business-process':77C 'code':48B,98C,149C 'command':65B 'cve':12A,15A 'default':167C 'deploy':169C 'direct':119C 'docker':24B,168C 'engin':45B,93C 'execut':64B,118C,150C 'field':56B,103C 'file':116C 'fresh':142C 'full':147C 'gate':136C 'heym':1A,25B,30B,70C,90C 'host':29B,35B,69B,84C,155C 'includ':140C 'infrastructur':85C 'issu':171C 'log':60B 'logged-in':59B 'node':11A,54B,107C 'observ':162C 'patch':174C 'path':128C 'platform':36B 'playwright':10A,26B,53B,106C 'playwrightcod':102C 'prior':86C 'process':79C,123C,160C 'py':115C 'python':6A,47B,97C 'rce':151C 'regist':143C 'remot':148C 'role':135C 'root':164C 'run':4A,46B,73C,156C 'sandbox':131C 'script':127C 'self':28B,34B,83C 'self-host':27B,33B,82C 'servic':159C 'string':99C,109C 'subprocess.popen':125C 'sys.executable':126C 'system':40B,75C 'taken':49B 'temporari':114C 'tool':23B 'uncheck':50B 'user':3A,62B,139C,161C 'valid':133C 'version':88C,176C 'via':9A,124C 'workflow':20B,44B,92C 'written':111C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Heym and let users log in to build workflows with Playwright nodes are exposed. Any authenticated account, including a newly registered one, can reach the vulnerable path, and the backend process reportedly runs as root in the default Docker setup. Hosted or managed Heym instances are the vendor's responsibility, and the report does not say whether they are patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agenticworkflows","aitooling","docker","heym","high","playwright","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67544':14A,17A 'arbitrari':5A 'authent':2A 'backend':8A 'cve':12A,15A 'heym':1A 'node':11A 'playwright':10A 'python':6A 'run':4A 'user':3A 'via':9A","search_b":"'agent':19B,39B 'agentic-workflow':18B 'ai':22B 'ai-tool':21B 'autom':42B 'backend':68B 'build':38B 'code':48B 'command':65B 'docker':24B 'engin':45B 'execut':64B 'field':56B 'heym':25B,30B 'host':29B,35B,69B 'log':60B 'logged-in':59B 'node':54B 'platform':36B 'playwright':26B,53B 'python':47B 'run':46B 'self':28B,34B 'self-host':27B,33B 'system':40B 'taken':49B 'tool':23B 'uncheck':50B 'user':62B 'workflow':20B,44B","search_c":"'0.0.71':89C,177C 'accept':94C 'account':144C 'achiev':146C 'agent':74C 'arbitrari':96C 'ast':132C 'authent':138C 'autom':80C 'backend':122C,154C 'build':71C 'busi':78C 'business-process':77C 'code':98C,149C 'default':167C 'deploy':169C 'direct':119C 'docker':168C 'engin':93C 'execut':118C,150C 'field':103C 'file':116C 'fresh':142C 'full':147C 'gate':136C 'heym':70C,90C 'host':84C,155C 'includ':140C 'infrastructur':85C 'issu':171C 'node':107C 'observ':162C 'patch':174C 'path':128C 'playwright':106C 'playwrightcod':102C 'prior':86C 'process':79C,123C,160C 'py':115C 'python':97C 'rce':151C 'regist':143C 'remot':148C 'role':135C 'root':164C 'run':73C,156C 'sandbox':131C 'script':127C 'self':83C 'self-host':82C 'servic':159C 'string':99C,109C 'subprocess.popen':125C 'sys.executable':126C 'system':75C 'temporari':114C 'user':139C,161C 'valid':133C 'version':88C,176C 'via':124C 'workflow':92C 'written':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-18T11:33:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67544","severity":null,"published_at":"2026-11-11T22:17:29+00:00","modified_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129446,"url":"https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129447,"url":"https://github.com/heymrun/heym/releases/tag/0.0.71","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129448,"url":"https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-18T11:33:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}