CVE-2026-100865

Deferred Deferred - Pending Action

Python Code Execution in Heym Workflow System

Publication date: 2026-09-27

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-28

Generated

2026-10-17

AI Q&A

2026-09-27

EPSS Evaluated

2026-10-16

NVD

CVE-2026-100865

EUVD

EUVD-2026-87830

Affected Vendors & Products

Vendor	Product	Version / Range
heym	heym	0.0.53
heym	heym	to 0.0.53 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-100865 affects the heym application versions before 0.0.53 and includes multiple vulnerabilities. The most critical is a Remote Code Execution (RCE) flaw due to unsafe use of Python's eval() function in the workflow condition evaluator, allowing arbitrary code execution as the backend user. Other issues include authentication bypass via failed webhook signature verification for Slack and Telegram, an OAuth redirect_uri validation flaw enabling JavaScript execution and auth cookie theft, and plaintext storage of sensitive tokens like WorkflowExecutionToken and PortalSession.

Detection Guidance

Check Heym version with 'heym --version' or inspect package files. Look for workflow files containing eval() or webhook configurations without signature verification. Search for plaintext tokens in database backups or logs. Monitor for unauthorized workflow executions or unexpected Python code execution.

Impact Analysis

This vulnerability can lead to full account takeover, unauthorized workflow execution, and remote code execution on the backend system. Attackers could trigger workflows with your credentials, execute malicious Python code, steal authentication cookies, or gain access to sensitive tokens stored in plaintext, potentially allowing long-term unauthorized access.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. The plaintext storage of tokens and potential unauthorized access to sensitive workflows could lead to data breaches, violating GDPR's data protection principles and HIPAA's security rules for protected health information. The RCE and authentication bypasses further exacerbate compliance risks by enabling unauthorized system access.

Mitigation Strategies

Upgrade Heym to version 0.0.53 or later immediately. Disable workflow editing permissions for untrusted users. Remove or secure Slack/Telegram webhook URLs. Validate OAuth redirect_uri schemes strictly. Encrypt stored tokens and rotate all exposed credentials.

Hi! I’m here to help you understand CVE-2026-100865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70