CVE-2026-77934CWE-1188

CVE-2026-77934

High · published October 20, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-10-20T05:17Z
References (4)
https://github.com/coze-dev/coze-studio/blob/ffec252d9e2600f61d49b8228a642335e84d5496/docker/.env.example#L234 · [email protected]https://github.com/coze-dev/coze-studio/commit/fcf40d1008c100108c23be051a49950283f2c2cf · [email protected]https://www.lasso.security/vulnerability-database/cve-2026-77934 · [email protected]https://www.vulncheck.com/advisories/coze-studio-before-0.5.0-rce-via-unsandboxed-local-python-code-runner · [email protected]
EPSS history
Timeline
  • 21 OCT 03:32Z
    EPSS moved — → 1%
    epss
  • 20 OCT 00:46Z
    Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
    cvelistv5
  • 20 OCT 00:46Z
    Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
    cvelistv5