Database/AI/ML frameworks & serving
Heym: Playwright node runs arbitrary Python on the backend for any authenticated user
Impact
The Playwright node in Heym takes a Python code string in its playwrightCode field, writes it to a temp file and runs it directly with the backend's interpreter. There is no sandbox, no validation and no role check. Any authenticated user, including a newly self-registered account, gets code execution on the backend host as the service user, which is root in the default Docker deployment. The attacker gets every credential the agent platform holds, and if the Docker socket is mounted as in the shipped config, the host as well. This is a different code path and a different fix from CVE-2026-67543.
Who can reach it
Any authenticated Heym user, including a freshly registered account, with network access to the backend. If open registration is enabled, this is effectively anyone who can reach the instance.
What to do
Upgrade Heym to 0.0.71 or later and restart the backend. Until you can upgrade, turn off open registration and limit network access to the instance. Since this is code execution as root, assume the backend environment's secrets are exposed on any reachable instance and rotate them.
References
Related entries
- InstructLab: model loading hardcodes trust_remote_code=True, executing code from HuggingFace modelsCVE-2026-6859 · InstructLab linux_train.py (hardcoded trust_remote_code=True)High
- Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code executionCVE-2026-71281 · Hugging Face peft - LoRA-GA and CorDA initialization (torch.load without weights_only)High
- ChromaDB (Rust): Missing authorization validationCVE-2026-8828 · ChromaDB (Rust)High
- LangBot: debug WebSocket on 0.0.0.0:5401 accepts plugin registration with no key setCVE-2026-90938 · LangBot plugin runtime (langbot_plugin debug WebSocket on 0.0.0.0:5401)High
- SGLang: unauthenticated PUT /route poisons the KV transfer routing table in disaggregated modeCVE-2026-92972 · SGLang prefill bootstrap service (unauthenticated PUT /route)High
- vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.