Heym skill executor runs untrusted Python without sandbox isolation

high severity · published 2026-11-11

A malicious or compromised skill can run Python inside the Heym backend execution context, without the Docker sandbox the Python tool path enforces, so the code can act on whatever the backend can reach on the self-hosted machine. The skill executor only applies a memory limit and an environment denylist, which does not contain untrusted code.

CVE: CVE-2026-67543

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2565 and your operating system.