Mbakgun

**Name of the Vulnerable Software and Affected Versions** heym versions prior to 0.0.109 **Description** A server-side request forgery (SSRF) issue exists in the Slack, Discord, and Crawler workflow nodes. These nodes use an unguarded HTTP client to send requests to URLs provided in user-created credentials via the `webhook url` or `flaresolverr url` variables. This bypasses the existing SSRF egress guard used by other nodes. Because the credential API only verifies that the URL is not empty, a registered user can configure a credential to point to internal addresses. This allows the backend to access loopback, private, link-local, or cloud-metadata endpoints and return the complete response body in the node output, resulting in a non-blind SSRF. **Recommendations** Update heym to version 0.0.109 or later.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.106 **Description** An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the destination URL using the `config` parameter, causing the server to send decrypted authentication secrets to an external endpoint controlled by the attacker. **Recommendations** Update to version 0.0.106 or later. Avoid using the `config` parameter in the 'POST /api/credentials/test' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** heym versions prior to 0.0.105 **Description** Authenticated users can bypass Server-Side Request Forgery (SSRF) protections—a flaw where an attacker induces a server to make requests to an unintended location—due to a failure in applying egress guards to integration services that utilize credential-supplied base URLs. This allows attackers to configure credentials pointing to loopback, private, or cloud-metadata addresses to read internal service responses returned as workflow node output. **Recommendations** Update to version 0.0.105 or later.

**Name of the Vulnerable Software and Affected Versions** heym versions prior to 0.0.91 **Description** This workflow automation platform stores and returns multiple capability secrets in plaintext. Affected secrets include webhook header-auth values, which are returned in cleartext by the 'GET /api/workflows/{id}' endpoint and persisted unsanitized into execution history. MCP API keys are stored in a plaintext column, returned in config/list responses, and accepted via the `key` query string, leading to leaks in logs, proxies, and Referer headers. Additionally, portal session tokens are stored and validated using plaintext equality with a 168-hour Time To Live (TTL), and workflow execution JSON Web Tokens (JWTs) are stored in full and re-listed by the 'GET .../execution-tokens' endpoint. Discord interaction tokens are also stored in full within the execution history, along with global variables. Users with read access to a workflow, share/team membership, or anyone with access to the database, backups, or logs can recover these secrets to execute workflows or impersonate the secret owner. **Recommendations** Update heym to version 0.0.91 or later.

**Name of the Vulnerable Software and Affected Versions** heym versions prior to 0.0.91 **Description** A sandbox escape exists in the expression engine's DotList map/filter and fallback resolver. Authenticated users can execute arbitrary Python code by crafting workflow expressions that utilize dunder attribute access through item expressions or the fallback resolver to access `os.system` and execute commands as the backend process. **Recommendations** Update heym to version 0.0.91 or later.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.53 **Description** Multiple security issues exist in the software. The workflow condition evaluator uses the Python `eval()` function without an effective sandbox, enabling users who can edit workflow branch/condition nodes or import malicious templates to execute arbitrary Python code as the backend process user. Additionally, Slack and Telegram webhook signature and secret-token verifications fail open when the trigger node lacks a `credentialId` or has an empty signing secret, allowing unauthenticated workflow triggers via the public webhook URL. The OAuth authorization endpoint fails to validate the `redirect uri` scheme, which could allow an attacker to use `javascript:` or `data:` schemes to steal authorization codes and execute JavaScript in the Heym origin, potentially accessing HttpOnly auth cookies. Furthermore, `WorkflowExecutionToken`, `PortalSession`, `HITLRequest.public token`, and `OAuthAuthorizationCode` values are stored in plaintext, meaning database exposure would reveal valid scoped bearer tokens, including portal and HITL tokens with a 168-hour TTL. **Recommendations** Update to version 0.0.53 or later.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.53 **Description** The software fails to verify Slack request signatures in cases where trigger nodes are missing credential IDs or contain empty signing secrets. This allows remote unauthenticated attackers to send forged Slack events to known webhook URLs, which can trigger workflows using the credentials of the owner. **Recommendations** Update to version 0.0.53 or later.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.53 **Description** Insufficient verification of the `X-Telegram-Bot-Api-Secret-Token` header occurs on Telegram webhook endpoints when the `credential id` is absent or the `secret token` is empty. This allows remote unauthenticated attackers to send forged Telegram updates, triggering workflows using the owner's configured credentials to execute actions based on attacker-supplied input. **Recommendations** Update to version 0.0.53 or later.