Expression-Engine - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/expression-engine/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 27 Sep 2026 03:08:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSandbox Escape in heym Expression Enginehttps://feed.craftedsignal.io/briefs/2026-09-heym-sandbox-escape/Sun, 27 Sep 2026 03:08:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-heym-sandbox-escape/The heym expression engine before version 0.0.91 is vulnerable to a sandbox escape via the DotList map/filter and fallback resolver, allowing authenticated users to achieve arbitrary Python code execution.The heym automation and expression engine platform, in versions prior to 0.0.91, contains a critical security flaw involving sandbox escape within its expression processing logic. Specifically, the DotList map/filter functionality and the fallback resolver do not correctly enforce boundary controls on object attribute access. An authenticated attacker can leverage this vulnerability by crafting malicious workflow expressions that utilize Python dunder (double underscore) attributes to traverse the object graph. By accessing these restricted attributes, an attacker can reach the os.system module, ultimately leading to arbitrary code execution within the context of the backend application process. This vulnerability poses a significant risk to organizations using the heym platform for workflow automation, as it allows unauthorized users to transition from limited expression evaluation to full system command execution on the host environment.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary system commands as the user running the heym backend process. This impact includes unauthorized access to system files, lateral movement within the hosting infrastructure, and the potential for full control over the automation environment. This vulnerability affects all deployments of heym version 0.0.90 and earlier.

Recommendation

Prioritized actions for security and infrastructure teams:

  • Immediately upgrade all instances of the heym platform to version 0.0.91 or later to remediate the vulnerable expression engine components.
  • Audit existing workflow expressions for unusual usage of dunder attributes (e.g., subclasses, globals, dict) within the application logs or configuration repository.
  • Restrict access to the workflow creation interface to verified, highly-trusted users only until the patch is deployed, as exploitation requires an authenticated account.
  • Monitor backend process activity for suspicious child processes spawned by the main heym application service.
]]>highadvisorysandbox-escapecode-executionexpression-engineweb-vulnerabilityrceauthentication-bypassplaintext-credentials