CVE-2026-77934
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
Risk Assessment
A registered user can execute arbitrary host commands and access sensitive data, including API keys and databases.
Recommendation
Update Coze Studio to version 0.5.0 or later that fixes the insecure default configuration.
Other vulnerabilities in Coze Studio
See all- CVE-2026-77935High
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
- CVE-2026-92795Medium
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
- CVE-2026-92788High
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
- CVE-2025-9604Low
coze-studio up to 0.2.4 uses a hard-coded cryptographic key in backend/domain/plugin/encrypt/aes.go (AuthSecretKey/StateSecretKey/OAuthTokenSecretKey). The attack can be remote but is considered difficult and highly complex. The vendor recommended deploying a patch and plans user-defined key management via configuration.
Original NVD description (English source)
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS