Overview

Coze Studio is an open-source AI agent development platform with visual tools for building, debugging and deploying agents. When it is deployed with the default make or make debug target, CODE_RUNNER_TYPE is set to local, which runs user-supplied Python directly as a python3 subprocess with no filesystem, network or capability isolation.

‍

A keyword filter is meant to block dangerous imports, but constructs such as __import__() bypass it. Self-registration is open in this deployment, so any user can run arbitrary code in the server container, which can reach MySQL, MinIO, Redis and etcd on the internal Docker network at their default credentials. The production target, make web, uses a hardened Deno and Pyodide sandbox and is not affected.

‍

Because any user who can register an account on a Coze Studio instance started with the default make or make debug target can run arbitrary code in the server container with a single request, reaching every co-located service at its default credentials, such deployments should switch to the sandboxed code runner immediately.

‍

Affected Product

coze-dev/coze-studio

‍

Affected Files

• backend/infra/coderunner/impl/direct/runner.go
• .env.debug.example (line 235: CODE_RUNNER_TYPE=local)

‍

Root Cause

When coze-studio is deployed using make or make debug, the environment variable CODE_RUNNER_TYPE defaults to local, selecting the direct Python runner at direct/runner.go. This runner passes user-supplied code to an unrestricted python3 subprocess with no filesystem isolation, network restriction, or capability dropping. The keyword-based import filter applied before code reaches the runner is bypassable via __import__() and similar constructs. The production deployment target (make web) uses a hardened Deno/pyodide sandbox and is not affected.

‍

PoC

Deploy coze-studio using the default make or make debug target (sets CODE_RUNNER_TYPE=local). Submit a code execution request with the following payload to bypass the import keyword filter and execute arbitrary system commands:

__import__('subprocess').check_output(['id'])

The runner executes the payload without restriction:

// backend/infra/coderunner/impl/direct/runner.go:81
cmd := exec.Command(fileutil.GetPython3Path(), "-c", fmt.Sprintf(pythonCode, code), string(bs)) // ignore_security_alert RCE

Internal Docker network services reachable from the server container include MySQL (root/root default), MinIO (minioadmin/minioadmin123 default), Redis (no auth default), and etcd (no auth default).

‍

Impact

An attacker who can reach the coze-studio API and create or use any account can execute arbitrary code in the server container. In the default debug deployment, self-registration is open, requiring no pre-issued credentials. Code runs in the server process environment with access to all environment variables (including provider API keys configured in the debug compose) and full connectivity to co-located Docker services at their default credentials. The entire debug deployment stack is compromised in a single request.

‍

Suggested Remediation

1. Make the secure runner (sandbox), no exposed database ports, and non-default credentials the make default, failing closed; do not ship CODE_RUNNER_TYPE=local as the default.

2. Do not expose MinIO on 0.0.0.0 with default credentials, even in the debug compose.

3. Even in sandbox mode, run the code runner in a network namespace with no route to the internal service network; don't rely on Deno permissions and non-default credentials alone.

‍

Additional Resources

• CVE-2026-77934 record

‍