Evidence · DiggingBeagle record
Coze CVE-2026-77934 local runner advisory
- Source role
- primary disclosure
Evidence record
Claim-level citations (1)
- supportsCoze debug deployment runs registered users' Python inside the server container: CVE-2026-77934 reports that make and make debug select an unrestricted local Python runner whose import filter can be bypassed by an authenticated, self-registered user.
Overview, Root Cause and PoC; CODE_RUNNER_TYPE=local and direct/runner.go