---
id: CVE-2026-100865
title: >-
  Heym before 0.0.53 evaluates workflow condition expressions using Python's
  eval() with insufficient sandboxing in the workflow executor service
summary: >-
  Heym before 0.0.53 evaluates workflow condition expressions using Python's
  eval() with insufficient sandboxing in the workflow executor service.
  Authenticated users can edit workflow condition nodes or import malicious
  templates to execu…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: heymrun
product: heym
affected:
  - heym < 0.0.53
published: '2026-09-27'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T20:57:50.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100865'
references:
  - url: >-
      https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
    label: disclosure@vulncheck.com
  - url: 'https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authentication-bypass-vulnerabilities
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-28T13:40:05.918419Z'
ingestedAt: '2026-09-27T02:41:45.583Z'
epss: 0.00399
epssPercentile: 0.34026
---

## Overview

Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.