Heym's agentic workflow system allows authenticated users to define custom Python tools. Prior to version 0.0.40 the engine’s sandbox relied on a blacklist of modules. Because standard‑library modules expose operating‑system, process, and filesystem functionality through public attributes, the broker’s validation functions mistakenly marked them as safe. An attacker who can create or edit a workflow with an Agent custom Python tool can therefore bypass this restriction, causing the backend service to execute the supplied code with exec(). The code runs with the privileges of the backend application user, granting full control over the host, including command execution and file manipulation.

The vulnerability affects the heymrun heym platform version 0.0.39 and earlier. Any deployment running those releases and permitting authenticated users to edit or create Agent custom Python tools is susceptible.

The CVSS score of 8.8 indicates high severity. EPSS is not available and the vulnerability is not yet listed in CISA’s KEV catalogue, suggesting no widespread exploitation yet. Nonetheless, the attack requires authentication, so an attacker with legitimate user credentials or that compromises a user can inject arbitrary code. No public exploit is reported, but the inability to sandbox user‑supplied Python exposes the backend service to full control of the host.