{"metadata": {"vulnerability": "CVE-2026-67544", "count": 9, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 3}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-29T18:47:17.074Z", "date_only": false, "value": "2026-07-29T18:47:17.074Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-67544", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-11T22:17:29.180Z", "date_only": false, "value": "2026-11-11T22:17:29.180", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67544", "record": "FKIE_CVE-2026-67544", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-11T22:17:29.323Z", "date_only": false, "value": "2026-11-11T22:17:29.323", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-67544", "record": "FKIE_CVE-2026-67544", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T22:42:52.547Z", "date_only": false, "value": "2026-11-11T22:42:52.547432Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117600221400366009", "record": "CVE-2026-67544", "field": "creation_timestamp", "uuid": "8442ac0a-77b9-493e-99cc-c52707a42389", "content": "CVE-2026-67544 Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user \u2014 including a freshly registered account \u2014 can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71.\nhttps://www.cve.org/CVERecord?id=CVE-2026-67544https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849bhttps://github.com/heymrun/heym/releases/tag/0.0.71#heymrun #heym#CVE_2026_67544#bot", "url": "https://infosec.exchange/users/cve/statuses/117600221400366009"}, {"timestamp": "2026-11-11T23:51:46.643Z", "date_only": false, "value": "2026-11-11T23:51:46.643348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6udgemoz3w44x", "record": "CVE-2026-67544", "field": "creation_timestamp", "uuid": "71a01697-0311-432c-bfe1-e07706170ea2", "content": "CVE-2026-67544 - Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field\nCVE ID : CVE-2026-67544\n \n Published : Nov. 11, 2026, 10:17 p.m. | 58\u00a0minutes ago\n \n Description : Heym builds and runs agentic systems and business-process automations on self-hosted infrastr...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/6udgemoz3w44x"}, {"timestamp": "2026-11-12T01:02:09.906Z", "date_only": false, "value": "2026-11-12T01:02:09.906656Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n23bi7xg3p24", "record": "CVE-2026-67544", "field": "creation_timestamp", "uuid": "97c43c4f-98a0-484d-8251-846eacbb3ad0", "content": "\ud83d\udfe0 CVE-2026-67544 - High (8.8)\n\nHeym builds and runs agentic systems and business-process automations on self-hosted infrastructu...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-67544/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3n23bi7xg3p24"}], "metrics": {"as_of": "2026-11-12T05:01:07.357Z", "anchors": {"origin": {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 26457.697549, "hours": 7.349360430277778, "days": 0.3062233512615741, "min_seconds": 26457.697549, "max_seconds": 26457.697549, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-11T21:40:09.660Z", "date_only": false, "value": "2026-11-11T21:40:09.660Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-67544", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T05:01:07.357Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}