Heym before version 0.0.21 contains a sandbox escape vulnerability in its custom Python tool executor. Authenticated users with workflow author privileges can use Python introspection primitives to bypass sandbox restrictions. This allows them to recover the unrestricted __import__ function, import modules that are normally blocked (e.g., os, subprocess), and access inherited backend environment variables. These environment variables may include sensitive information such as database credentials and encryption keys. Consequently, attackers can execute arbitrary commands on the host with the backend service user's privileges. The vulnerability is assigned CVE-2026-45227 with a CVSS 4.0 score of 8.7 (high severity). There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated workflow author to escape the Python sandbox and execute arbitrary commands on the host system as the backend service user. This includes accessing sensitive environment variables containing database credentials and encryption keys, potentially leading to data compromise and further system control. The vulnerability poses a high risk due to the ability to bypass sandbox protections and execute unrestricted code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workflow author privileges to trusted users only and monitor for suspicious activity related to Python tool execution. Avoid exposing sensitive backend environment variables to the affected service if possible.