Coze-dev vulnerabilities
We track 3 vulnerabilities in Coze-dev products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Coze-dev vulnerabilities
- 8.3 High severity
coze-studio: Authorization Bypass Through User-Controlled Key
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's w
- 8.8 High severity
coze-studio: Initialization of a Resource with an Insecure Default
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subproces
- 8.8 High severity
coze-studio: Incorrect Authorization
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory d