CVE-2026-45797
Received Received - Intake

Stored XSS in HeyForm via Unauthenticated SVG Upload

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45797
EUVD
EUVD-2026-45983

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
heyform heyform to 3.0.0-rc.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in HeyForm, an open-source form builder. The /api/upload endpoint allowed unauthenticated file uploads including SVG files. Uploaded SVGs were stored in a static directory and served with Content-Type: image/svg+xml, causing browsers to execute embedded JavaScript in the SVG files. This enabled attackers to upload malicious SVGs without authentication, leading to stored XSS attacks on the heyform domain.

Detection Guidance

Check for unauthorized SVG file uploads in the static assets directory, particularly under /static/upload. Look for files with .svg or .svgz extensions or MIME types 'image/svg+xml' or 'application/svg+xml'. Review server logs for POST requests to /api/upload without authentication.

Impact Analysis

An attacker could upload a malicious SVG file containing JavaScript that sends sensitive data like session cookies or form submissions to an attacker-controlled server. Victims accessing the uploaded file would have their sessions hijacked, accounts taken over, data exfiltrated, or fall for phishing attacks. The JavaScript executes under the heyform domain with access to authenticated GraphQL endpoints, enabling full account compromise for users and administrators.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The stored XSS attack may result in data breaches, unauthorized disclosure, or modification of sensitive data, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Block SVG and SVGZ file uploads by updating the file filter to reject '.svg', '.svgz' extensions and 'image/svg+xml' MIME types. Add middleware to return 403 for SVG requests in /static/upload. Remove SVG from allowed MIME types in static file serving and enforce 'X-Content-Type-Options: nosniff' headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart