CVE-2026-77934 in Studio
Summary
by MITRE • 10/20/2026
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Coze Studio prior to version 0.5.0 represents a critical failure in application security design, specifically categorized under CWE-94 Improper Control of Generation of Code or Command often referred to as code injection. The core technical flaw lies in the insecure default configuration where workflow execution nodes are processed within an unsandboxed Python3 subprocess environment. This architectural decision effectively grants any authenticated user with access to create workflows the ability to execute arbitrary operating system commands on the host infrastructure running the Coze Studio instance. By leveraging standard Python mechanisms, attackers can bypass superficial input validation measures such as regex-based import filters through techniques like using _import_('subprocess') or similar dynamic invocation methods that are not strictly restricted by the application's security controls.
From an operational perspective, this vulnerability allows for complete remote code execution with the privileges of the user account running the Coze Studio service. The impact is severe and multifaceted, enabling attackers to exfiltrate sensitive environment variables which typically contain database credentials, cloud provider keys, and internal API tokens. Specifically, the attacker can access critical data stores including MySQL databases containing application data, MinIO object storage holding files or backups, Redis caches potentially storing session information or temporary secrets, and etcd distributed configuration stores that may hold cluster-level configurations. This level of access effectively compromises the entire backend infrastructure associated with the Coze Studio deployment, leading to potential data breaches, service disruption, and further lateral movement within the network.
In terms of threat modeling, this vulnerability aligns closely with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing system commands via Python scripts, and T1537 Transfer Data to Cloud Account if attackers utilize cloud APIs found in environment variables to exfiltrate data. The attack vector is classified as remote due to the requirement of only registered user access rather than direct network-level exploitation, making it a significant risk for multi-tenant environments or public-facing deployments where user registration is open or easily accessible.
Mitigation strategies must prioritize immediate remediation by upgrading Coze Studio to version 0.5.0 or later, which addresses this insecure default configuration. In the interim, if an upgrade is not immediately feasible, administrators should implement strict network segmentation to isolate the Coze Studio host from critical data stores like MySQL and Redis. Additionally, enforcing least-privilege principles for the service account running the application can limit the scope of damage; ensuring the process runs with minimal permissions reduces the ability to access sensitive files or execute privileged commands. Implementing a robust Web Application Firewall may also help detect and block attempts to inject malicious code into workflow nodes, although this is not a substitute for fixing the underlying architectural flaw in the execution environment.