---
id: CVE-2026-100865
title: Heym before 0.0.53 contains multiple independent vulnerabilities
summary: >-
  Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The
  workflow condition evaluator uses Python eval() without an effective sandbox,
  allowing any user who can edit a workflow branch/condition node — or who can
  import a…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: heymrun
product: heym
affected:
  - heym < 0.0.53
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T02:17:26.410'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100865'
references:
  - url: 'https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authentication-bypass-vulnerabilities
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-27T02:41:45.583Z'
---

## Overview

Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval() without an effective sandbox, allowing any user who can edit a workflow branch/condition node — or who can import a workflow template containing a malicious condition node — to execute arbitrary Python code as the backend process user when the workflow runs. (2) Slack webhook signature verification and (3) Telegram webhook secret-token verification fail open when the trigger node has no credentialId or an empty signing secret, allowing anyone who knows the public webhook URL to trigger workflows with the owner's credentials without authentication. (4) The OAuth authorization endpoint does not validate the redirect_uri scheme, so an attacker who registers a public OAuth client with a javascript: or data: redirect_uri and lures a victim to the consent screen receives the authorization code and executes attacker-controlled JavaScript in the Heym origin, including access to the victim's HttpOnly auth cookie. (5) WorkflowExecutionToken, PortalSession, HITLRequest.public_token, and OAuthAuthorizationCode values are stored in plaintext, so any database read exposure yields valid scoped bearer tokens, including portal and HITL tokens with a 168-hour TTL that permit workflow execution on behalf of the owner.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.