Coze Studio: any registered user gets code execution from a workflow code node by default

Impact

Coze Studio is an agent/LLM application platform; its workflow code nodes run user Python in a plain python3 subprocess by default, with only a regex filter on imports. __import__('subprocess') walks straight past that filter, so any account that can create a workflow executes commands as the platform process. The record states the attacker reaches environment variables and model API keys and the backing MySQL, MinIO, Redis and etcd services - which on a self-hosted deployment is the platform's whole data and credential set, including the inference provider keys that bill to the operator. Where Coze Studio shares a GPU node or namespace with serving workloads, this is an untrusted-tenant foothold on that node.

Who can reach it

Any registered Coze Studio user who can create or run a workflow. Authentication is required, but self-registration makes that a low bar; the dangerous configuration is the shipped default.

What to do

Upgrade to Coze Studio 0.5.0 or later (fix commit fcf40d1008c1 in coze-dev/coze-studio); the insecure default lives in docker/.env.example, so review your own deployment's env file after upgrading and switch the code runner off the local unsandboxed path. Rollout is a container redeploy and daemon restart. Rotate the model API keys and the MySQL, MinIO, Redis and etcd credentials that the platform held, since any user could already have read them.

References

Related entries

• Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
• Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training nodeCVE-2026-86169 · Axolotl (multipack patch path, trust_remote_code guard)High
• vLLM: rejected requests leak decode-worker metadata until the worker exhausts memoryCVE-2026-93436 · vLLM NIXL KV connector (decode-side metadata cleanup for rejected requests)High
• vLLM: negative token IDs in embeddings requests poison the CUDA context and wedge the engineCVE-2026-93592 · vLLM (/v1/embeddings and /pooling token ID validation)High
• vLLM: incomplete NIXL kv_transfer_params kills the decode engine with an uncaught KeyErrorCVE-2026-94622 · vLLM NIXL KV connector (kv_transfer_params metadata handling)High
• vLLM: multi-prompt completion request trips a NIXL prefix-caching assertion and kills the decode workerCVE-2026-94623 · vLLM NIXL connector prefix caching (NixlBaseConnectorWorker._apply_prefix_caching)High