Vulnerability Description
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
FAQ
What is CVE-2026-100865?
CVE-2026-100865 is a vulnerability with a CVSS score of 8.8 (HIGH). Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes o...
How severe is CVE-2026-100865?
CVE-2026-100865 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100865?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.