---
id: "CVE-2026-77934"
kind: "vulnerability"
aliases: ["CVE-2026-77934"]
title: "Coze Studio: any registered user runs commands via workflow code nodes"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "coze-studio", "fixed": ["0.5.0"], "affected": ">= 0, < 0.5.0", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "coze-studio", "rce", "self-hosted", "workflow"]
not_affected_if: ["managed-hosting", "not-exposed-to-network", "registration-disabled", "sandbox-runner", "version-0.5.0-or-later"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:34:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77934", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:34:06+00:00"}]
---

# Coze Studio: any registered user runs commands via workflow code nodes

Coze Studio before 0.5.0 runs workflow code nodes in an unsandboxed python3 subprocess by default. A registered user can bypass the regex import filter with __import__('subprocess') to run commands, reading environment variables, model API keys, and access to MySQL, MinIO, Redis and etcd.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:coze-studio affected >= 0, < 0.5.0 fixed 0.5.0

## How to check

Check CODE_RUNNER_TYPE in docker/.env (or the server container env). 'local' or unset on a pre-0.5.0 install means exposed; 'sandbox' means workflow code nodes run in deno+pyodide. Confirm the image tag: docker ps | grep coze-studio-server (cozedev/coze-studio-server:<tag> older than 0.5.0 is affected). Also check whether open registration is on (DISABLE_USER_REGISTRATION empty = anyone can sign up).

## Fix

Upgrade to 0.5.0 or later (0.5.1 is current in the release list I read). Set CODE_RUNNER_TYPE=sandbox explicitly in docker/.env and restart; existing .env files keep the old value after upgrade, so check it. Set DISABLE_USER_REGISTRATION=true with an ALLOW_REGISTRATION_EMAIL allowlist. If a pre-0.5.0 instance was reachable by untrusted users, rotate model API keys and the MySQL, MinIO and Redis credentials in .env.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77934
- 2026-10-23T22:34:06+00:00 analyst — Fix is 0.5.0 (flipped CODE_RUNNER_TYPE default to sandbox, commit fcf40d1, released 29 Oct 2025). Trigger is the local runner, which was the default in v0.3.0 .env.example. Not read: Lasso advisory (no URL found), NVD page (empty fetch). No exploitation reports found; PoC referenced by CVE record as Lasso technical description, not read. Note 0.5.1 and earlier have other CVEs (CVE-2026-77935, which says 'through 0.5.1').

## Documents

- [advisory] VulnCheck: Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner https://www.vulncheck.com/advisories/coze-studio-before-0.5.0-rce-via-unsandboxed-local-python-code-runner
- [describes] docker/.env.example at v0.3.0: CODE_RUNNER_TYPE=local https://github.com/coze-dev/coze-studio/blob/ffec252d9e2600f61d49b8228a642335e84d5496/docker/.env.example
- [fix] fcf40d1 Set the Code Runner environment to sandbox by default (#2339) https://github.com/coze-dev/coze-studio/commit/fcf40d1008c100108c23be051a49950283f2c2cf
- [fix] coze-studio releases (latest v0.5.1) https://github.com/coze-dev/coze-studio/releases

## From the sources

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_