CVE-2026-100864GHSA-87x2-9jwx-7gh4
heym before 0.0.91 Remote Code Execution via Expression Engine
heymrun heym
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.69%Chance of exploitation activity in the next 30 days, higher than 52% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.0.91heymCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.
Text from CVE List
Affected versions 2
- heymaffected: all versions before 0.0.91CVE List
- heymunaffected: 0.0.91CVE List