What happened
Published 2026-10-13 (CVSS 8.8, CWE-78/94/693) via GitHub advisory. The blacklist-based Python sandbox in python_tool_executor.py is bypassable through public attributes of allowed stdlib modules; runner executes tool with exec() as backend application user. Verified via NVD REST API.
Why it matters
Agentic workflow platforms that self-host and run user-supplied Python need real sandboxing, not denylists. This bypass converts 'create a workflow' into backend host compromise, and combined with weak self-registration controls reaches beyond the intended user set.
Attack vector
Authenticated user (including self-registered users where reachable) writes a custom Python tool whose standard-library imports expose os/process/filesystem capabilities through public attributes that pass _safe_import() and _validate_code_safety(); the runner then exec()s it as backend user.
Affected systems
Heym (agentic systems / business-process automation platform) < 0.0.40
Mitigation
Upgrade Heym to 0.0.40 (GHSA-wcgw-9hfw-f6f2). Until patched, restrict who can create workflow custom tools and run the backend as least-privilege.