CVE-2026-77934

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-77934

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77934.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-77934

Published

2026-10-20T00:46:12Z

Modified

2026-10-20T10:46:39Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Details

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1188"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77934.json"
}

References

Affected packages

Git / github.com/coze-dev/coze-studio

Affected ranges

Type

GIT

Repo

https://github.com/coze-dev/coze-studio

Events

Introduced

Fixed

5f11c49733cc5db7c572491e30932e34f94fd8a6

Fixed

fcf40d1008c100108c23be051a49950283f2c2cf

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.5.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "fcf40d1008c100108c23be051a49950283f2c2cf"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*

v0.1.1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.5

v0.3.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77934.json"