Heym versions before 0.0.21 allow an authenticated workflow author to escape the sandbox by using Python introspection to retrieve the unrestricted __import__ function. This path permits the import of normally blocked modules such as os and subprocess, enabling the execution of arbitrary host commands. Consequently, an attacker can read sensitive environment variables that contain database credentials or encryption keys and run commands as the backend service user, compromising confidentiality, integrity, and availability of the underlying host system.

All deployments of the Heym tool runner earlier than version 0.0.21 (e.g., 0.0.20 and older) are affected. The advisory references a release of 0.0.21 that addresses the issue, so any installation using a pre‑0.0.21 build is vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability that, if exploited, grants full command execution on the host. The EPSS for this flaw is not available, so the current exploit probability cannot be quantified, but the lack of inclusion in the CISA KEV catalog does not reduce its inherent risk. Attackers must be authenticated workflow authors to reach the vulnerable code path; once this condition is met, they can achieve remote code execution with the privileges of the backend service. The combination of a high CVSS score and the ability to recover all forbidden modules makes exploitation both feasible and dangerous.