Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: heymrun heym — GitHub Security Advisory (GHSA-pm6h-x3h5-j38h) Clear all filters
TI-2026-65083 CVE-2026-101050 · GHSA-2x2v-2gpw-j9ff

Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Priority HIGH 69

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0038 Published 2026-09-27 Fixed in 0.0.53 CWE-287
TI-2026-65082 CVE-2026-101049 · GHSA-2m9j-ffq7-cjqc

Heym before 0.0.53 Slack Webhook Signature Verification Bypass

Priority HIGH 69

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0038 Published 2026-09-27 Fixed in 0.0.53 CWE-287
TI-2026-65003 CVE-2026-100865 · GHSA-grmf-qq9c-vgpp

Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape

Priority HIGH 73

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00399 Published 2026-09-27 Fixed in 0.0.53 CWE-94