CVE-2026-100865
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient…
- Risk score
- 68/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
- Affected
- See advisory
- Fix
- Upgrade the product to 0.0.53 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: python
References
Original description
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Last activity 27 Sep 2026. Patch Forecast updates every hour.