CVE-2026-55376: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in heymrun heym

Heymrun heym versions before 0.0.40 contain an OS command injection vulnerability (CWE-78) caused by improper neutralization of special elements in the Python tool executor sandbox. The sandbox uses a blacklist approach but allowed standard-library modules expose OS, process, and filesystem capabilities via public attributes that pass safety checks (_safe_import() and _validate_code_safety()). Consequently, an authenticated user who can create or edit workflows with an Agent custom Python tool can execute arbitrary commands using exec() in the backend application context. Self-registration affects reachability, but portal triggering alone does not grant code execution. The vulnerability is resolved in version 0.0.40.

Successful exploitation allows an authenticated user with workflow creation or editing privileges to execute arbitrary OS commands and perform file operations with the backend application's user permissions. This can lead to full compromise of the host environment, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade heymrun heym to version 0.0.40 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause in the sandbox implementation.