---
id: CVE-2026-45227
title: Heym < 0.0.21 Sandbox Escape via Python Introspection
summary: >-
  Heym before 0.0.21 contains a sandbox escape vulnerability in the custom
  Python tool executor that allows authenticated workflow authors to bypass
  sandbox restrictions by using object-graph introspection primitives. Attackers
  can use Pyt…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-693
vendor: heymrun
product: heym
affected:
  - heym < 0.0.21
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-14T12:33:16.358963Z'
exploitAvailable: true
published: '2026-05-12'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:41.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45227'
references:
  - url: 'https://github.com/heymrun/heym/releases/tag/v0.0.21'
    label: heym 0.0.21 Release Notes
  - url: 'https://github.com/heymrun/heym/pull/94'
  - url: >-
      https://github.com/heymrun/heym/commit/32b7e809d987d9b018ec8daa2cdaf48f627f26f1
  - url: >-
      https://www.vulncheck.com/advisories/heym-sandbox-escape-via-python-introspection
tags:
  - cve.org
  - exploit-available
epss: 0.00289
epssPercentile: 0.21569
ingestedAt: '2026-11-08T14:51:22.423Z'
---

## Overview

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.

## Affected

- `heym < 0.0.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.