Read the docs
TI-2026-33041 Aliases CVE-2026-45226GHSA-p953-2g5p-33c5

Heym < 0.0.21 Authorization Bypass in Workflow Execution

Priority LOW 35CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix Fixed heym (heymrun): 0.0.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heymrunheymbefore 0.0.210.0.21Patch availableCNA
  • heym Vendorheymrun Affected before 0.0.21 Fixed in 0.0.21 Patch available CNA

Remediation

  • Fix · CNA heym (heymrun) Fixed in 0.0.21

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    heymrun heym 0.0.21

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python IntrospectionPriority HIGH 73
    • TI-2026-33040 Heym < 0.0.21 Path Traversal File Upload via upload_file()Priority HIGH 65
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45226
  2. 2026-10-03 Alias added: GHSA-p953-2g5p-33c5

References

Patch 1

Other 2

  • TI-2026-71768 Sandbox escape in heym Python tool allows command execution CVSS 3.1HIGH 8.8
  • TI-2026-65003 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CVSS 4.0HIGH 8.7
  • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression Engine CVSS 4.0HIGH 8.7
  • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python Introspection CVSS 4.0HIGH 8.7
  • TI-2026-65083 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CVSS 4.0HIGH 8.3
  • TI-2026-65082 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CVSS 4.0HIGH 8.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences