CVE-2026-100864

high

Description

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

References

https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine

https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87829

Details

Source: Mitre, NVD

Published: 2026-09-27

Updated: 2026-09-28

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00686