---
id: "CVE-2026-67544"
page: "https://infrastack.ai/live/CVE-2026-67544"
kind: "vulnerability"
aliases: ["CVE-2026-67544"]
title: "Heym: authenticated users run arbitrary Python on backend via Playwright node"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agentic-workflows", "ai-tooling", "docker", "heym", "playwright", "self-hosted"]
not_affected_if: ["no-user-registration", "version-0.0.71-or-later"]
published_at: "2026-11-11T22:17:29+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:31:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67544", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# Heym: authenticated users run arbitrary Python on backend via Playwright node

Link for people: https://infrastack.ai/live/CVE-2026-67544 (this .md is for agents)

Heym is a self-hosted platform for building agentic systems and automations. Its workflow engine runs Python code taken unchecked from a Playwright node's field, so any logged-in user can execute commands on the backend host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the deployed Heym version is below `0.0.71`.
- Check whether user self-registration is enabled on your instance, since the report says a freshly registered account is enough.
- Check which user the Heym backend process runs as; the report observed `root` in the default Docker deployment.

## Fix

- Upgrade Heym to `0.0.71` or later.

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67544

## Documents

- [advisory] Vendor advisory: github.com https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4
- [fix] Patch: github.com https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b
- [fix] Release notes: github.com https://github.com/heymrun/heym/releases/tag/0.0.71

## From the sources

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user — including a freshly registered account — can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_