Database/AI/ML frameworks & serving
Heym: skill Python runs in the backend process without the Docker sandbox used for tool code
Impact
Heym runs user Python tools inside a locked-down Docker sandbox, but skill Python takes a different path. It runs as a local subprocess of the backend with only a 512 MB memory limit and a 7-key environment denylist. A user who can supply or run a skill can read the backend's filesystem, reach the network, and read any environment variable not on the denylist, which can include model-provider keys and other credentials the agent platform holds. In the shipped Docker configuration the backend runs as root with /var/run/docker.sock mounted, so this goes all the way to root on the host. That turns one shared or untrusted skill into control of the machine and every container on it.
Who can reach it
Authenticated Heym user (low privilege) who can create or run a skill, or a shared/untrusted skill run by such a user. Network access to the Heym backend.
What to do
Upgrade Heym to 0.0.70 or later and restart the backend. The fix is a service restart, not a node reboot. Separately, review the deployment: running the backend as root with the Docker socket mounted is what turns this into host root, so drop the socket mount and run as non-root where the workflow allows it. If skills from untrusted or shared sources have already run, rotate the credentials in the backend environment.
References
Related entries
- Heym: Playwright node runs arbitrary Python on the backend for any authenticated userCVE-2026-67544 · Heym workflow engine (Playwright node playwrightCode field)High
- InstructLab: model loading hardcodes trust_remote_code=True, executing code from HuggingFace modelsCVE-2026-6859 · InstructLab linux_train.py (hardcoded trust_remote_code=True)High
- Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code executionCVE-2026-71281 · Hugging Face peft - LoRA-GA and CorDA initialization (torch.load without weights_only)High
- ChromaDB (Rust): Missing authorization validationCVE-2026-8828 · ChromaDB (Rust)High
- LangBot: debug WebSocket on 0.0.0.0:5401 accepts plugin registration with no key setCVE-2026-90938 · LangBot plugin runtime (langbot_plugin debug WebSocket on 0.0.0.0:5401)High
- SGLang: unauthenticated PUT /route poisons the KV transfer routing table in disaggregated modeCVE-2026-92972 · SGLang prefill bootstrap service (unauthenticated PUT /route)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.