Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-77934

Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Coze
Products
Coze Studio
CVE-2026-77935

Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Coze
Products
Coze Studio
CVE-2026-92795

Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Coze
Products
Coze Studio
CVE-2026-92788

Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Coze
Products
Coze Studio
CVE-2026-7023

ByteDance coze-studio databaseTool database_impl.go ExecuteSQL sql injection

A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bytedance Coze
Products
Coze-studio Coze Studio