Read the docs
TI-2026-67737 Aliases CVE-2026-105396GHSA-84cp-gph2-pv3x

Origin header spoofing in Heym leaks HITL review tokens

Priority LOW 23CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Heym before v0.0.112 trusts spoofable Origin or X-Forwarded-Host headers when build_public_base_url() builds the links for human-in-the-loop (HITL) review requests. An unauthenticated remote attacker can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, which captures capability tokens (CWE-346). The attacker can then use those tokens to submit review decisions that run with the owner's credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00098 0th percentileScored 2026-11-07
Fix Fixed heym (heymrun): 0.0.112

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heymrunheymbefore 0.0.1120.0.112Patch availableCNA
  • heym Vendorheymrun Affected before 0.0.112 Fixed in 0.0.112 Patch available CNA

Remediation

Update Heym to version 0.0.112, which is the fixed version listed for this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA heym (heymrun) Fixed in 0.0.112

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-105396
  2. 2026-10-05 Alias added: GHSA-84cp-gph2-pv3x

References

Advisory 1

  • TI-2026-71768 Sandbox escape in heym Python tool allows command execution CVSS 3.1HIGH 8.8
  • TI-2026-65003 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CVSS 4.0HIGH 8.7
  • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression Engine CVSS 4.0HIGH 8.7
  • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python Introspection CVSS 4.0HIGH 8.7
  • TI-2026-65083 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CVSS 4.0HIGH 8.3
  • TI-2026-65082 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CVSS 4.0HIGH 8.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences