CVE-2026-100864
heym before 0.0.91 Remote Code Execution via Expression Engine
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 27, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 27, 2026
Description
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
heymheymrun |
|
References
- GitHub Security Advisory (GHSA-87x2-9jwx-7gh4)vendor-advisory
- VulnCheck Advisory: heym before 0.0.91 Remote Code Execution via Expression Enginethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.