CVE-2026-45227 describes a protection mechanism failure in heymrun's heym product prior to version 0.0.21. The vulnerability exists in the custom Python tool executor sandbox, where authenticated users can leverage Python introspection primitives to escape sandbox restrictions. By recovering the unrestricted __import__ function, attackers can import modules that are normally blocked, such as os and subprocess. This enables access to inherited backend environment variables that hold sensitive information including database credentials and encryption keys. Consequently, attackers can execute arbitrary commands on the host with the backend service user's privileges. The CVSS 4.0 base score is 8.7, indicating a high severity vulnerability. No official patch or remediation level has been documented yet.

Successful exploitation allows authenticated workflow authors to bypass sandbox restrictions, access sensitive backend environment variables, and execute arbitrary commands as the backend service user. This compromises confidentiality, integrity, and availability of the backend system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workflow author permissions to trusted users only and monitor for suspicious activity related to Python tool execution.