What happened
CVE-2026-67544 / GHSA-mp23-7m6r-jfw4: the Playwright node's custom 'playwrightCode' string was written to a temporary Python file and run via subprocess in-process with no isolation. Any authenticated user could therefore execute arbitrary code as the backend process, inheriting DATABASE_URL, SECRET_KEY/ENCRYPTION_KEY and provider keys. The fix also coerced injected boolean step fields and scrubbed backend secrets from the subprocess environment.
Why it matters
This is a direct agent-execution RCE in an agentic workflow platform: a user (or a prompt injection steering a workflow) gains code execution in the host running the agents, with access to the platform's database and provider credentials.
Attack vector
The Playwright node's custom playwrightCode field is written to a temp .py file and executed in-process via subprocess with no isolation, so any authenticated user can run arbitrary Python with the full backend environment and its secrets.
Affected systems
heymrun/heym < 0.0.71 (Playwright node custom playwrightCode field)
Mitigation
Upgrade to heym 0.0.71+, which disables custom playwrightCode by default (fail-closed gate at the execution sink) and routes enabled custom code into a hardened throwaway container with no backend secrets, no Docker socket, and dropped capabilities; operators opt in with HEYM_PLAYWRIGHT_CUSTOM_CODE_ENABLED=true on trusted isolated deployments.