CVE-2026-100864
Received Received - Intake

Heym Sandbox Escape via Python Code Execution

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100864
EUVD
EUVD-2026-87829

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
heym heym to 0.0.91 (exc)
heym heym to 0.0.90 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a sandbox escape vulnerability in the heym application before version 0.0.91. It allows authenticated users to execute arbitrary Python code by crafting workflow expressions using dunder attribute access. Attackers can access os.system and run commands as the backend process.

Detection Guidance

Check the version of heym installed on your system. If it is version 0.0.91 or higher, the vulnerability is not present. Commands to check: 'heym --version' or 'pip show heym'. Inspect workflow expressions for use of dunder attributes like __class__.__base__.__subclasses__ in .map(), .filter(), or distinctBy() functions.

Impact Analysis

An attacker with authenticated access could execute system commands, steal credentials, access databases, or perform other malicious actions on the backend system. This could lead to data breaches, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade heym to version 0.0.91 or later immediately. If upgrading is not possible, restrict access to workflow editing features to trusted users only and disable the expression engine's fallback resolver. Monitor for suspicious activity in backend processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100864. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart