High
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Announced Group revision 1
Original source ↗CVE-2026-100865
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-100865
heym
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "heymrun",
"product": "heym",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.0.53",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.0.53",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-100865
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #3114 · Revision 1
- Added to Heist Feed
- Publisher date