CVE-2026-100865GHSA-pm6h-x3h5-j38h
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
heymrun heym
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.0.53heymCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Text from CVE List
Affected versions 2
- heymaffected: all versions before 0.0.53CVE List
- heymunaffected: 0.0.53CVE List