CVE-2026-67543

Untrusted skills could run in the Heym backend process environment

Heym · Heym skill execution

First documented disclosure · Review checkpoint

Summary

The skill execution path lacked the isolation used for other Python tools. The skill could access backend files, credentials or network resources. Host impact depended on deployment privileges.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The skill execution path lacked the isolation used for other Python tools.

Conditions required

The instance ran a skill containing untrusted code.

Potential impact

The skill could access backend files, credentials or network resources. Host impact depended on deployment privileges.

Affected versions and configurations

Before 0.0.70.

Fix and mitigation status

The maintainer explicitly reported a fix in 0.0.65 in July. The November CNA names 0.0.70 as corrected. Use 0.0.70 or later.

Practical next steps

Upgrade Heym and review permissions granted to skill workers.

Operating lesson

Apply authorization and isolation to every backend path that can act on behalf of an agent.

Evidence and limits

The maintainer explicitly reported a fix in 0.0.65 in July. The November CNA names 0.0.70 as corrected. The public disclosure was on 2026-07-11. The CVE record was published on 2026-11-11.

Sources