CVE-2026-63428
Received Received - Intake

Stored Hidden Fields Injection in HeyForm

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63428
EUVD
EUVD-2026-45985

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
heyform heyform to 3.0.0-rc.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in HeyForm allows an anonymous form submitter to inject arbitrary key-value pairs into submission data without validation. The completeSubmission function stores these hidden fields as-is, bypassing the form's declared schema. This can include malicious payloads like XSS scripts or fake authorization metadata.

Detection Guidance

Check HeyForm application logs for submissions containing unexpected hidden fields or unusual key-value pairs. Inspect webhook payloads for injected metadata or XSS payloads. Review form configurations to ensure hiddenFields schema matches expected values.

Impact Analysis

The injected fields are forwarded unchanged to all webhook integrations registered on the form. This can lead to webhook payload poisoning, where downstream systems processing the data may be compromised. Attackers could execute XSS attacks or manipulate authorization metadata.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, which may violate GDPR's principles of data integrity and confidentiality (Article 5) and HIPAA's requirements for protecting sensitive health information. Injection of fake authorization metadata or XSS payloads could result in unauthorized access to personal data, triggering compliance breaches under both regulations.

Mitigation Strategies

Upgrade HeyForm to version 3.0.0-rc.9 or later to apply the patch. Review all forms for unauthorized hidden fields and remove any suspicious entries. Validate webhook payloads before processing to detect injected data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart