Coze Studio versions earlier than 0.5.0 expose a misconfiguration that allows any registered user to run Python code in an unsandboxed subprocess. By exploiting the flaw with a regex‑bypass __import__('subprocess'), an attacker can execute arbitrary shell commands inside the host environment. The consequence is full remote code execution, enabling the theft of environment variables, model API keys, and direct access to the database and storage services exposed by the application.

The vulnerable configuration applies to the Coze Studio product from coze‑dev. All installations of this software released before version 0.5.0 carry the misconfiguration and may accept user‑sourced workflow code nodes that are executed without sandboxing.

The CVSS score of 8.7 categorizes this issue as high severity. The EPSS score is not available, however the denial of sandboxing makes the exploitation straightforward for any authenticated user with permission to create workflows. This vulnerability is not listed in the CISA KEV catalog, but the presence of a user‑controllable code path poses a substantial risk to confidentiality, integrity, and availability of the host system.