{"id":"CVE-2026-100865","title":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service","summary":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execu…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"vendor":"heymrun","product":"heym","affected":["heym < 0.0.53"],"published":"2026-09-27","updated":"2026-09-28","sourceUpdated":"2026-09-28T20:57:50.143","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100865","references":[{"url":"https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83","label":"disclosure@vulncheck.com"},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h","label":"disclosure@vulncheck.com"},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authentication-bypass-vulnerabilities","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-28T13:40:05.918419Z"},"ingestedAt":"2026-09-27T02:41:45.583Z","epss":0.00399,"epssPercentile":0.34026,"slug":"CVE-2026-100865","body":"## Overview\n\nHeym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":211949,"id":"CVE-2026-100865","ts":1790604800068,"field":"exploit_available","old":"false","new":"true"}]}