{"id":"CVE-2026-100865","aliases":["EUVD-2026-87830","GHSA-grmf-qq9c-vgpp","GHSA-pm6h-x3h5-j38h"],"status":"published","title":"Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00399,"percentile":0.3469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-94"],"published":"2026-09-27T01:28:53Z","modified":"2026-10-28T02:31:06Z","products":[{"vendor":"heymrun","product":"heym"}],"references":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100865","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authentication-bypass-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-grmf-qq9c-vgpp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100865.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101049.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101049","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101050.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101050","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-100865","title":"Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","status":"published","published":"2026-09-27T01:28:53.874Z","modified":"2026-09-28T13:40:50.761Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:06.925367Z"}],"euvd":[{"id":"EUVD-2026-87830","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","status":"published","published":"2026-09-27T01:28:53Z","modified":"2026-09-28T13:40:50Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:53.425914Z"}],"ghsa":[{"id":"GHSA-grmf-qq9c-vgpp","title":"Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition...","description":"Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval() without an effective sandbox, allowing any user who can edit a workflow branch/condition node — or who can import a workflow template containing a malicious condition node — to execute arbitrary Python code as the backend process user when the workflow runs. (2) Slack webhook signature verification and (3) Telegram webhook secret-token verification fail open when the trigger node has no credentialId or an empty signing secret, allowing anyone who knows the public webhook URL to trigger workflows with the owner's credentials without authentication. (4) The OAuth authorization endpoint does not validate the redirect_uri scheme, so an attacker who registers a public OAuth client with a javascript: or data: redirect_uri and lures a victim to the consent screen receives the authorization code and executes attacker-controlled JavaScript in the Heym origin, including access to the victim's HttpOnly auth cookie. (5) WorkflowExecutionToken, PortalSession, HITLRequest.public_token, and OAuthAuthorizationCode values are stored in plaintext, so any database read exposure yields valid scoped bearer tokens, including portal and HITL tokens with a 168-hour TTL that permit workflow execution on behalf of the owner.","status":"published","published":"2026-09-27T03:31:06Z","modified":"2026-09-27T18:31:24Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:12:31.359269Z"}],"nvd":[{"id":"CVE-2026-100865","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","status":"published","published":"2026-09-27T02:17:26.41Z","modified":"2026-09-28T20:57:50.143Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100865","title":"Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","status":"published","published":"2026-09-27T01:28:53.874Z","modified":"2026-10-28T02:30:59.398161771Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"CVE-2026-101049","title":"Heym before 0.0.53 Slack Webhook Signature Verification Bypass","description":"Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.","status":"published","published":"2026-09-27T16:28:28.128Z","modified":"2026-10-28T02:31:04.459017075Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"CVE-2026-101050","title":"Heym before 0.0.53 Authentication Bypass via Telegram Webhook","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T16:28:28.766Z","modified":"2026-10-28T02:31:06.647648794Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:53.83521Z"}]}}