CVE-2026-100865

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.53

Description Multiple security issues exist in the software. The workflow condition evaluator uses the Python eval() function without an effective sandbox, enabling users who can edit workflow branch/condition nodes or import malicious templates to execute arbitrary Python code as the backend process user. Additionally, Slack and Telegram webhook signature and secret-token verifications fail open when the trigger node lacks a credentialId or has an empty signing secret, allowing unauthenticated workflow triggers via the public webhook URL. The OAuth authorization endpoint fails to validate the redirect uri scheme, which could allow an attacker to use javascript: or data: schemes to steal authorization codes and execute JavaScript in the Heym origin, potentially accessing HttpOnly auth cookies. Furthermore, WorkflowExecutionToken, PortalSession, HITLRequest.public token, and OAuthAuthorizationCode values are stored in plaintext, meaning database exposure would reveal valid scoped bearer tokens, including portal and HITL tokens with a 168-hour TTL.

Recommendations Update to version 0.0.53 or later.