---
id: CVE-2026-100863
title: >-
  Heym versions 0.0.90 and earlier contain two server-side request forgery
  (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91
summary: >-
  Heym versions 0.0.90 and earlier contain two server-side request forgery
  (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91.
  First, the LLM image-edit input loader (_load_image_bytes) fetched
  caller-controlled HT…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: heymrun
product: heym
affected:
  - heym < 0.0.91
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T02:17:26.117'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100863'
references:
  - url: 'https://github.com/heymrun/heym/security/advisories/GHSA-6rph-qqcv-jqh4'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/heym-before-0.0.91-ssrf-via-image-fetching-and-ipv6-validation
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-27T02:41:45.582Z'
---

## Overview

Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image-edit input loader (_load_image_bytes) fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check and bypassing the egress-pinning HTTP client; because the workflow DSL supports "imageInput": "$userInput.body.imageUrl", a webhook or API caller can choose the fetch target when a workflow author uses that expression, allowing requests to loopback, RFC1918, and cloud metadata endpoints. Second, _is_public_address unwrapped only IPv4-mapped IPv6 addresses, so IPv6 transition forms — the NAT64 well-known prefix 64:ff9b::/96, deprecated IPv4-compatible ::x.x.x.x addresses, and 6to4 (2002::/16, classified as globally routable by Python 3.11.0 through 3.11.9) — could carry loopback, RFC1918, link-local, or cloud-metadata IPv4 destinations past both the initial URL validation and the dial-time IP pin. Version 0.0.91 routes the image loader through guard_http_url and the guarded client, evaluates NAT64 and IPv4-compatible addresses by their embedded IPv4 address, and refuses 64:ff9b:1::/48, 6to4, and Teredo (2001::/32) outright.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.