Quick answers
- Is CVE-2026-77934 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77934 being exploited in the wild.
- How severe is CVE-2026-77934?
- High severity, with a CVSS score of 8.8, published 20 October 2026.
- Which products and versions are affected?
- Coze Studio before 0.5.0.
- Is there a fix for CVE-2026-77934?
- Yes: fixed in 0.5.0. Until then: Change the CODE_RUNNER_TYPE environment variable from "local" to "sandbox" to enable sandboxing of Python code execution, restricting environment variable access via the CODE_RUNNER_ALLOW_ENV configuration. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77934 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-77934?
- Check whether you run Coze Studio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.5.0
Change the CODE_RUNNER_TYPE environment variable from "local" to "sandbox" to enable sandboxing of Python code execution, restricting environment variable access via the CODE_RUNNER_ALLOW_ENV configuration.
Technical details
Coze Studio before 0.5.0 defaults to executing Python code in unsandboxed subprocess environments. An authenticated user can bypass the regex import filter using __import__('subprocess') to gain arbitrary command execution on the host. Access to environment variables and backend service credentials enables further lateral movement and data theft. The fix applies sandboxing via deno and pyodide by default in version 0.5.0 onwards.
Affected products
- Coze Coze Studio before 0.5.0
Timeline
- 2026-10-20: disclosed