Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: heymrun heym 0.0.91 Clear all filters
TI-2026-65002 CVE-2026-100864 · GHSA-gxgj-2794-2q5v

heym before 0.0.91 Remote Code Execution via Expression Engine

Priority HIGH 73

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00859 Published 2026-09-27 Fixed in 0.0.91 CWE-94
TI-2026-65001 CVE-2026-100863 · GHSA-j62x-q9gf-62p4

Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Priority LOW 24

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-09-27 Fixed in 0.0.91 CWE-918
TI-2026-65000 CVE-2026-100862 · GHSA-v692-j72v-6h8x

heym before 0.0.91 Multiple Secrets Plaintext Storage

Priority LOW 30

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00194 Published 2026-09-27 Fixed in 0.0.91 CWE-312