Coze Studio 0.5.0 Predecessors Exposed to Command Injection via Python Nodes

Coze Studio versions released before 0.5.0 contain an insecure default configuration that permits command execution. This vulnerability allows any registered user to run workflow code nodes within an unsandboxed python3 subprocess environment.

What happened

The National Vulnerability Database records CVE-2026-77934 as a high-severity issue with a CVSS score of 8.7. The flaw stems from weak default settings in Coze Studio, a product by coze-dev. Specifically, the application fails to properly sandbox Python code execution within workflow nodes.

According to the NVD record, attackers can exploit this by bypassing the existing regex import filter. They achieve this by using the __import__('subprocess') function. This technique allows them to spawn a python3 subprocess that operates outside intended security boundaries.

Why it matters

Successful exploitation grants attackers the ability to execute arbitrary commands on the host system. This access can lead to the theft of environment variables and model API keys. Attackers may also gain access to internal data stores.

The vulnerability specifically exposes connections to MySQL, MinIO, Redis, and etcd. These services often contain sensitive application data or configuration secrets. Because the flaw exists in the default configuration, any deployment using these versions is potentially at risk.

What to watch

• Monitor for unexpected python3 processes spawned by the Coze Studio service.
• Look for attempts to import the subprocess module in workflow logs.
• Check for unauthorized access to internal databases like MySQL or Redis.
• Review environment variable access patterns for anomalies.

Signals worth monitoring

Security teams should focus on process creation events related to the Coze Studio application. Look for new python3 instances that do not originate from scheduled maintenance tasks. Alerting on the specific use of __import__('subprocess') can help identify bypass attempts early. Check network connections from the application server to internal data stores like Redis or etcd. Unusual outbound traffic to unknown IP addresses may indicate data exfiltration of stolen API keys. Review audit logs for any workflow code nodes that execute commands outside the expected sandbox.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Coze Studio

• Verify the installed version of Coze Studio and compare it against the 0.5.0 threshold.
• Audit workflow code nodes for any usage of subprocess or import functions.
• Rotate any environment variables or API keys that may have been exposed.
• Restrict network access from the Coze Studio host to internal databases until patched.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Coze Studio are affected by CVE-2026-77934?

All versions of Coze Studio before 0.5.0 are affected by this vulnerability.

How can attackers bypass the import filter in Coze Studio?

Attackers can use the __import__('subprocess') function to bypass the regex import filter.

What internal services are at risk of exposure?

MySQL, MinIO, Redis, and etcd are specifically mentioned as accessible services.