CVE-2026-100864

HIGHCVSS 8.8

Description

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

Timeline

Published:September 27th, 2026 2:17 AM

Last modified:September 28th, 2026 8:57 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4
https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine
https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4

Source: NIST NVD · Data may lag official sources by up to one minute