Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-100865: Heym before 0.0.53 lets attackers run code on server
CVE-2026-100865 · published 22 days ago
Summary
The Heym service versions earlier than 0.0.53 allow anyone with a valid login to change workflow rules or upload crafted templates that cause the system to execute any Python or operating‑system command it runs. This can give an attacker control over the server that hosts your Heym instance. Update to version 0.0.53 or later, or restrict who can edit workflows and import templates, to stop the risk.
What to do
- Update heymrun heym to version 0.0.53 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| heymrun | heym | < 0.0.53 |
Original advisory text
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
References
- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
- https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authent... Vendor Advisory
- https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1008... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100865 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-1010... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-101049 Vendor Advisory
- https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-1010... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-101050 Vendor Advisory
- https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-vi... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-94Code Injection
CWE-287Improper Authentication
Timeline
Published27 Sep 2026
Updated19 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100865 · NVD
CVE-2026-100865 · MITRE
CVE-2026-100865 · OSV
GHSA-pm6h-x3h5-j38h · GHSA
CVE-2026-101050 · OSV
CVE-2026-101049 · OSV
Track software like this
Free during beta