{"id":"CVE-2026-77934","kind":"vulnerability","aliases":["CVE-2026-77934"],"related":[],"title":"Coze Studio: any registered user runs commands via workflow code nodes","description":"Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.","summary":"Coze Studio before 0.5.0 runs workflow code nodes in an unsandboxed python3 subprocess by default. A registered user can bypass the regex import filter with __import__('subprocess') to run commands, reading environment variables, model API keys, and access to MySQL, MinIO, Redis and etcd.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"coze-studio","fixed":["0.5.0"],"affected":">= 0, < 0.5.0","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","coze-studio","rce","self-hosted","workflow"],"not_affected_if":["managed-hosting","not-exposed-to-network","registration-disabled","sandbox-runner","version-0.5.0-or-later"],"how_to_check":"Check CODE_RUNNER_TYPE in docker/.env (or the server container env). 'local' or unset on a pre-0.5.0 install means exposed; 'sandbox' means workflow code nodes run in deno+pyodide. Confirm the image tag: docker ps | grep coze-studio-server (cozedev/coze-studio-server:<tag> older than 0.5.0 is affected). Also check whether open registration is on (DISABLE_USER_REGISTRATION empty = anyone can sign up).","fix":"Upgrade to 0.5.0 or later (0.5.1 is current in the release list I read). Set CODE_RUNNER_TYPE=sandbox explicitly in docker/.env and restart; existing .env files keep the old value after upgrade, so check it. Set DISABLE_USER_REGISTRATION=true with an ALLOW_REGISTRATION_EMAIL allowlist. If a pre-0.5.0 instance was reachable by untrusted users, rotate model API keys and the MySQL, MinIO and Redis credentials in .env.","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:57+00:00","updated_at":"2026-10-23T22:34:06+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:32:57Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Coze Studio to 0.5.0 or later.","reach":"network","title":"Coze Studio: any registered user runs commands via workflow code nodes","impact":"high","summary":"Coze Studio before 0.5.0 runs workflow code nodes in an unsandboxed python3 subprocess by default. A registered user can bypass the regex import filter with __import__('subprocess') to run commands, reading environment variables, model API keys, and access to MySQL, MinIO, Redis and etcd.","category":"ai-tooling","who_cares":["coze-studio","self-hosted","ai-agents"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs OS commands on the server and steals keys and database credentials.","analyst_note":"Confirm the exact fixed version and whether the default config is the only trigger, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-77934 and the Coze Studio release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-0.5.0-or-later","managed-hosting"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":2933,"output_tokens":426,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact fixed version and whether the default config is the only trigger, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-77934 and the Coze Studio release notes.","search":"'-2026':13A,16A '-77934':14A,17A '0.5.0':38B,82C 'access':72B,126C 'agent':23B 'ai':22B,25B 'ai-ag':21B 'ai-tool':24B 'allow':89C 'api':69B,123C 'attack':106C 'bypass':54B,108C 'code':10A,41B,99C 'command':7A,64B,95C,118C 'configur':87C 'contain':83C 'coze':1A,19A,28B,35B,79C 'coze-studio':18A,27B 'cve':12A,15A 'default':49B,86C 'environ':66B,120C 'etcd':78B,131C 'execut':94C 'filter':58B,112C 'host':33B 'import':57B,60B,111C,114C 'insecur':85C 'key':70B,124C 'minio':75B,128C 'model':68B,122C 'mysql':74B,127C 'node':11A,42B,100C 'python3':46B,104C 'rce':30B 'read':65B 'redi':76B,129C 'regex':56B,110C 'regist':4A,51B,91C 'run':6A,39B,63B,97C,117C 'self':32B 'self-host':31B 'steal':119C 'studio':2A,20A,29B,36B,80C 'subprocess':47B,61B,105C,115C 'tool':26B 'unsandbox':45B,103C 'user':5A,52B,92C 'variabl':67B,121C 'via':8A 'workflow':9A,34B,40B,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77934","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-77934:252","url":null,"severity":null,"published_at":"2026-10-23T22:34:06+00:00","modified_at":"2026-10-23T22:34:06+00:00","first_seen_at":"2026-10-23T22:34:06+00:00","fetched_at":"2026-10-23T22:34:06+00:00","note":"Fix is 0.5.0 (flipped CODE_RUNNER_TYPE default to sandbox, commit fcf40d1, released 29 Oct 2025). Trigger is the local runner, which was the default in v0.3.0 .env.example. Not read: Lasso advisory (no URL found), NVD page (empty fetch). No exploitation reports found; PoC referenced by CVE record as Lasso technical description, not read. Note 0.5.1 and earlier have other CVEs (CVE-2026-77935, which says 'through 0.5.1')."}],"documents":[{"id":1506,"url":"https://www.vulncheck.com/advisories/coze-studio-before-0.5.0-rce-via-unsandboxed-local-python-code-runner","title":"VulnCheck: Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1507,"url":"https://github.com/coze-dev/coze-studio/commit/fcf40d1008c100108c23be051a49950283f2c2cf","title":"fcf40d1 Set the Code Runner environment to sandbox by default (#2339)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1508,"url":"https://github.com/coze-dev/coze-studio/blob/ffec252d9e2600f61d49b8228a642335e84d5496/docker/.env.example","title":"docker/.env.example at v0.3.0: CODE_RUNNER_TYPE=local","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1509,"url":"https://github.com/coze-dev/coze-studio/releases","title":"coze-studio releases (latest v0.5.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}