Stored XSS in HeyForm Form Builder

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the HeyForm form builder. A low-privileged team member can inject malicious JavaScript into form field titles. When a team owner views the form, the payload executes, allowing privilege escalation and full account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HeyForm instances for unsanitized rich text inputs in form field titles. Check for stored JavaScript payloads in form schemas or database entries. Review GraphQL mutations like updateFormSchemas for suspicious HTML/JavaScript content. Monitor browser console logs for unexpected script executions when privileged users view forms.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take over your HeyForm account, access form submissions, team data, and integration credentials. They could also transfer team ownership to themselves, gaining complete control over your workspace.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The stored XSS allows attackers to escalate privileges and take over accounts, potentially exposing regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade HeyForm to version 3.0.0-rc.7 or later to apply the patch. If upgrading is not possible, implement input sanitization for rich text fields by removing unsafe HTML attributes and blocking malicious URL protocols. Review and sanitize existing form data to remove any stored XSS payloads. Restrict team member permissions to minimize privilege escalation risks.

Useful 0 Not Useful 0