CVE-2026-100864

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.91

Description A sandbox escape exists in the expression engine's DotList map/filter and fallback resolver. Authenticated users can execute arbitrary Python code by crafting workflow expressions that utilize dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

Recommendations Update heym to version 0.0.91 or later.