Host access is a runtime control that decides how much of the underlying machine and platform APIs a script can reach. In a sandboxed JavaScript or Python environment, tight host access may block file reads, network calls, process creation, and direct access to internal services. Broad host access does the opposite: it lets script code interact with the server’s operating system, environment variables, secrets, and application APIs.
In cyber security, this setting is critical because it often determines whether a scripting feature stays a convenience or becomes an attack path. If untrusted input is executed with overly broad host access, an attacker may escape the intended workflow logic and reach sensitive data or system functions. Defenders should treat host access as part of the trust boundary, disable unnecessary capabilities, and prefer allowlists, sandboxing, and separate execution environments for user-supplied code. Reviewing default runtime permissions is especially important in automation platforms that execute inline scripts.