Remote Code Execution in Coze Studio via Workflow Nodes

Coze Studio versions prior to 0.5.0 contain an insecure default configuration that fails to properly sandbox Python code execution within workflow nodes. An authenticated attacker can manipulate these workflow nodes to execute arbitrary code within a subprocess. By bypassing the existing regex-based import filters - specifically using the __import__('subprocess') technique - an attacker can gain command execution on the host environment. This vulnerability poses a significant risk to the integrity and confidentiality of the Coze Studio instance, as successful exploitation allows an attacker to exfiltrate sensitive environment variables, extract model API keys, and pivot to connected backend services such as MySQL, MinIO, Redis, and etcd.

Impact

Successful exploitation of CVE-2026-77934 enables an attacker to achieve remote code execution as the user running the Coze Studio service. This access facilitates the theft of credentials (API keys) and unauthorized access to internal data stores (MySQL, MinIO, Redis, etcd), potentially resulting in full database compromise or cross-environment lateral movement.

Recommendation

1. Upgrade Coze Studio to version 0.5.0 or later to ensure proper sandboxing of Python code execution.
2. Review logs for unexpected subprocess or os.system calls originating from the service process.
3. Restrict network access for the Coze Studio backend infrastructure to prevent unauthorized access to internal databases (MySQL, Redis, etcd, MinIO) if the process is compromised.