CVE-2026-55376

Executive Summary

CVE-2026-55376 is a sandbox escape vulnerability in Heym, a platform for building and running agentic systems and business-process automations on self-hosted infrastructure. An authenticated user capable of creating or editing a workflow containing an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py, resulting in arbitrary command execution and filesystem operations as the backend application user. The issue affects all versions prior to 0.0.40 and carries a CVSS score of 8.8 (High), reflecting high confidentiality, integrity, and availability impact.

Technical Analysis

Heym allows users to define "Agent custom Python tools" that are executed by a backend service. To constrain what a user-supplied tool can do, the platform implements a blacklist-based sandbox in the module backend/app/services/python_tool_executor.py. This sandbox relies on two functions named in the advisory: _safe_import() and _validate_code_safety(). The first is intended to restrict which modules a tool may import, and the second is intended to statically validate that supplied code does not contain dangerous constructs before it is run. After passing these checks, the runner executes the tool using Python's exec() primitive.

The core weakness (CWE-78, OS Command Injection) is that the sandbox is blacklist-based rather than a true isolation boundary. The advisory states that "allowed standard-library modules expose operating-system, process, and filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety()." In other words, modules that are considered safe to import still transitively expose OS, process, and filesystem operations via their public attributes. Because validation inspects only what the blacklist anticipates and does not enumerate reachable attributes of permitted modules, a crafted tool can obtain references to process-spawning and file-manipulation capabilities while still satisfying both checks. Once exec() runs the tool, those capabilities are available with the privileges of the backend application user.

This class of flaw is a well-known failure mode of import/code blacklists: the Python runtime exposes enormous reachable surface through legitimate standard-library objects, so any denylist that does not account for attribute traversal and indirection is bypassable. The advisory does not disclose the specific module path or attribute chain used, so the exact primitive should not be assumed; the defining characteristic is that the bypass leverages allowed modules and their public attributes, not disallowed imports.

Attack surface: any workflow that incorporates an Agent custom Python tool. The advisory notes that self-registration affects reachability and that "portal triggering alone does not grant code control." This is an important scoping detail: merely triggering a workflow through the portal is insufficient. Code control requires the ability to create or edit a workflow that contains an Agent custom Python tool. In practice this means the vulnerability is reachable by any actor who can author or modify such workflows — which, in self-hosted deployments with self-registration enabled, can include self-registered users. The CVSS vector confirms this: PR:L (Low privileges required) with AV:N (Network), and high impact across C/I/A with S:U (scope unchanged).

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred from the vulnerability class (blacklist sandbox escape leading to OS command injection) and the details in the advisory. Specific module names or attribute chains are deliberately omitted because they are not disclosed.

1. Reconnaissance/target identification: The attacker identifies a reachable, self-hosted Heym instance running a version prior to 0.0.40. Exposure is network-facing (AV:N). Where self-registration is enabled, the attacker can obtain an authenticated account; otherwise, they need an existing low-privileged account. The requirement is the ability to create or edit a workflow that includes an Agent custom Python tool, since portal triggering alone does not yield code control.

2. Triggering the flaw class: With that capability, the attacker authors (or edits) a workflow containing an Agent custom Python tool. The tool's code is written to reference OS, process, and filesystem capabilities through public attributes of modules that are permitted by _safe_import(). Because the blacklist in _validate_code_safety() does not account for these transitive attributes, the code is deemed safe and accepted.

3. Payload/execution: The backend runner subsequently executes the tool via exec(). At this point the crafted code runs as native Python with the privileges of the backend application user, and the intended sandbox is effectively escaped. The payload can invoke process execution and file operations — the vulnerability class is OS command injection reached via sandbox escape. No fixed payload string can be provided here, as the exact primitive is undisclosed; the operational objective is command and filesystem access under the application account.

4. Post-exploitation impact: Per CVSS, impact is High for confidentiality, integrity, and availability. The attacker can read sensitive application data and files, modify workflow or platform state, and disrupt service availability, all within the backend application user's permissions. Self-hosted infrastructure means the blast radius can extend to other services and data reachable by that account on the host or internal network. Scope is Unchanged (S:U), so the direct security authority remains the vulnerable component.

Impact Assessment

Business impact is significant for organizations running self-hosted Heym instances. Successful exploitation yields code execution and file operations as the backend service account, enabling data exfiltration, tampering with automations and business processes, and denial of service. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) summarizes the risk: remote reachability, low attack complexity, no user interaction, low privileges required, and high C/I/A impact. Because the platform is designed to run agentic systems and business-process automations, a compromised workflow engine can be leveraged to pivot into connected systems and automated downstream actions. Affected systems are Heym deployments with versions below 0.0.40 where users can create or edit workflows with Agent custom Python tools; reachability is increased when self-registration is enabled. Blast radius depends on the permissions and network reach of the backend application user on the self-hosted host.

Detection Guidance

Sigma Rule

title: Heym Python Tool Sandbox Escape - Suspicious Child Process from Backend
id: 9f2c1e7a-5537-46c1-9b0a-6d13e4f7c001
status: experimental
description: Detects unusual child process creation attributable to the Heym backend application user, consistent with sandbox escape and OS command execution (CVE-2026-55376).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55376
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    type: 'EXECVE'
  selection_indicators:
    exe|endswith:
      - '/sh'
      - '/bash'
      - '/python3'
    key:
      - 'execve'
  condition: selection_parent and selection_indicators
falsepositives:
  - Legitimate administrative scripts running under the same account
level: medium
tags:
  - attack.t1059
  - cve.2026.55376

YARA Rule

rule CVE_2026_55376_Heym_Sandbox_Escape_Artifacts
{
    meta:
        description = "Detects workflow or log artifacts referencing Heym python tool executor paths and sandbox bypass activity"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55376"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "python_tool_executor.py"
        $p2 = "_safe_import"
        $p3 = "_validate_code_safety"
        $p4 = "exec("
        $p5 = "Agent custom Python tool"

    condition:
        uint16(0) == 0x0A0D or true
        and 2 of ($p1, $p2, $p3, $p4, $p5)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-55376 Heym Workflow Python Tool Submission Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"workflow"; nocase; http.request_body; content:"python"; nocase; http.request_body; content:"import"; nocase; reference:cve,2026-55376; classtype:attempted-user; sid:2026553760; rev:1;)

Elastic Detection

process where event.type == "start" and process.parent.name in ("python", "python3") and
process.name in ("sh", "bash", "ls", "cat", "curl", "wget", "chmod") and
process.parent.executable : "*backend*"

Splunk SPL Query

index=linux sourcetype=auditd type=EXECVE
| search exe IN ("/bin/sh","/bin/bash","/usr/bin/python3", "/usr/bin/curl", "/usr/bin/wget")
| stats count values(exe) as executables by host, uid, ppid
| where count > 0

Wazuh OSSEC Rule

<group name="heym,cve-2026-55376,">
  <rule id="100376" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.parent.name">python3</field>
    <field name="process.name">^(sh|bash|curl|wget|nc)$</field>
    <description>CVE-2026-55376: Possible Heym Python tool sandbox escape spawning shell/command process</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict who can create or edit workflows containing Agent custom Python tools; treat workflow-authoring permission as code-execution permission.
• Disable self-registration on self-hosted instances to reduce reachability, since self-registration affects reachability even though portal triggering alone does not grant code control.
• Restrict network exposure of the Heym instance to trusted networks only.
• Run the backend application user with least privilege and minimal filesystem/network reach to reduce post-exploitation blast radius.

2. Patch/upgrade steps:

• The issue is fixed in version 0.0.40. Upgrade Heym to 0.0.40 or later as soon as it is available in your deployment channel.
• Validate the deployed version post-upgrade and confirm the sandbox in backend/app/services/python_tool_executor.py reflects the fixed behavior.

3. Long-term hardening:

• Replace blacklist-based import and code validation with a true isolation boundary (e.g., a locked-down interpreter, container/namespace sandbox, or restricted execution context) rather than denylists that can be bypassed via public attributes of allowed modules.
• Avoid using exec() on user-influenced code where an isolated runtime is feasible.
• Apply the principle of least privilege to the backend application user and segment the host network.

References

• NVD — CVE-2026-55376: https://nvd.nist.gov/vuln/detail/CVE-2026-55376
• CWE-78: Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No public PoC, exploit code, or Nuclei template is available. CVE-2026-55376 is not listed in CISA KEV, and no threat actor campaigns or exploit-in-the-wild evidence have been observed at the time of writing.