CVE-2026-67544

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.71

Description The workflow engine allows authenticated users, including those with new accounts, to achieve remote code execution on the backend host. The system accepts an arbitrary Python code string through the playwrightCode field of a Playwright node, which is then written to a temporary file and executed by the backend process using the subprocess.Popen() function. This process occurs without sandboxing, Abstract Syntax Tree (AST) validation—a method of analyzing source code structure—or role-based access controls. In default Docker deployments, the code executes with root privileges.

Recommendations Update to version 0.0.71. Restrict the use of the playwrightCode field in Playwright nodes until the update is applied.