CVE-2026-67544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67544", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-29T18:47:17.074Z", "datePublished": "2026-11-11T21:40:09.660Z", "dateUpdated": "2026-11-13T00:07:39.700Z"}, "containers": {"cna": {"title": "Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4"}, {"name": "https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b", "tags": ["x_refsource_MISC"], "url": "https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b"}, {"name": "https://github.com/heymrun/heym/releases/tag/0.0.71", "tags": ["x_refsource_MISC"], "url": "https://github.com/heymrun/heym/releases/tag/0.0.71"}], "affected": [{"vendor": "heymrun", "product": "heym", "versions": [{"version": "< 0.0.71", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T21:40:09.660Z"}, "descriptions": [{"lang": "en", "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user \u2014 including a freshly registered account \u2014 can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71."}], "source": {"advisory": "GHSA-mp23-7m6r-jfw4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T00:07:07.794238Z", "id": "CVE-2026-67544", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T00:07:39.700Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "heym", "vendor": "heymrun", "versions": [{"status": "affected", "version": "< 0.0.71"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user \u2014 including a freshly registered account \u2014 can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71."}], "id": "CVE-2026-67544", "lastModified": "2026-11-13T02:18:58.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67544", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-13T00:07:07.794238Z", "version": "2.0.3"}}]}, "published": "2026-11-11T22:17:29.180", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b"}, {"source": "security-advisories@github.com", "url": "https://github.com/heymrun/heym/releases/tag/0.0.71"}, {"source": "security-advisories@github.com", "url": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.0.71)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "heym", "source": "cna", "vendor": "heymrun"}, "product": "heym", "vendor": "heymrun"}], "created": "2026-11-12T20:30:08.624603+00:00", "updated": "2026-11-13T07:30:12.030336+00:00", "vendors": ["heymrun", "heymrun$PRODUCT$heym"]}