Read the docs
TI-2026-65001 Aliases CVE-2026-100863GHSA-j62x-q9gf-62p4

Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image-edit input loader (_load_image_bytes) fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check and bypassing the egress-pinning HTTP client; because the workflow DSL supports "imageInput": "$userInput.body.imageUrl", a webhook or API caller can choose the fetch target when a workflow author uses that expression, allowing requests to loopback, RFC1918, and cloud metadata endpoints. Second, _is_public_address unwrapped only IPv4-mapped IPv6 addresses, so IPv6 transition forms — the NAT64 well-known prefix 64:ff9b::/96, deprecated IPv4-compatible ::x.x.x.x addresses, and 6to4 (2002::/16, classified as globally routable by Python 3.11.0 through 3.11.9) — could carry loopback, RFC1918, link-local, or cloud-metadata IPv4 destinations past both the initial URL validation and the dial-time IP pin. Version 0.0.91 routes the image loader through guard_http_url and the guarded client, evaluates NAT64 and IPv4-compatible addresses by their embedded IPv4 address, and refuses 64:ff9b:1::/48, 6to4, and Teredo (2001::/32) outright.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed heym (heymrun): 0.0.91

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heymrunheymbefore 0.0.910.0.91Patch availableCNA
  • heym Vendorheymrun Affected before 0.0.91 Fixed in 0.0.91 Patch available CNA

Remediation

  • Fix · CNA heym (heymrun) Fixed in 0.0.91

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    heymrun heym 0.0.91

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression EnginePriority HIGH 73
    • TI-2026-65000 heym before 0.0.91 Multiple Secrets Plaintext StoragePriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100863
  2. 2026-10-03 Alias added: GHSA-j62x-q9gf-62p4

References

Advisory 1

  • TI-2026-71768 Sandbox escape in heym Python tool allows command execution CVSS 3.1HIGH 8.8
  • TI-2026-65003 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CVSS 4.0HIGH 8.7
  • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression Engine CVSS 4.0HIGH 8.7
  • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python Introspection CVSS 4.0HIGH 8.7
  • TI-2026-65083 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CVSS 4.0HIGH 8.3
  • TI-2026-65082 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CVSS 4.0HIGH 8.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences