Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100863— Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Quick assessment

Affected
heymrun heym
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Heym 0.0.90 及更早版本中存在两个服务器端请求伪造（SSRF）出口控制缺陷，这两个漏洞均已在 0.0.91 版本的 app/services/ssrf_guard.py 中得到修复。 首先，LLM 图像编辑输入加载器（_load_image_bytes）使用未经充分保护的 httpx.get 获取由调用者控制的 HTTP/HTTPS URL，仅进行了协议方案（scheme）检查，而未使用具备出口限制功能的 HTTP 客户端。由于工作流 DSL（领域特定语言）支持 “imageInput”: “$userI

CVSS 5.0 · Medium EPSS 0.25% · P14
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100863

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Heym before 0.0.91 SSRF via image fetching and IPv6 validation
Source: CVE Program / CVE List V5
Vulnerability Description
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image-edit input loader (_load_image_bytes) fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check and bypassing the egress-pinning HTTP client; because the workflow DSL supports "imageInput": "$userInput.body.imageUrl", a webhook or API caller can choose the fetch target when a workflow author uses that expression, allowing requests to loopback, RFC1918, and cloud metadata endpoints. Second, _is_public_address unwrapped only IPv4-mapped IPv6 addresses, so IPv6 transition forms — the NAT64 well-known prefix 64:ff9b::/96, deprecated IPv4-compatible ::x.x.x.x addresses, and 6to4 (2002::/16, classified as globally routable by Python 3.11.0 through 3.11.9) — could carry loopback, RFC1918, link-local, or cloud-metadata IPv4 destinations past both the initial URL validation and the dial-time IP pin. Version 0.0.91 routes the image loader through guard_http_url and the guarded client, evaluates NAT64 and IPv4-compatible addresses by their embedded IPv4 address, and refuses 64:ff9b:1::/48, 6to4, and Teredo (2001::/32) outright.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
heymrun heym 0 ~ 0.0.91 -

II. Public POCs for CVE-2026-100863

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100863

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100863 (1)

Other References for CVE-2026-100863 (1)

Same Patch Batch · heymrun · 2026-09-27 · 10 CVEs total

CVE-2026-100864 8.8 HIGH heym before 0.0.91 Remote Code Execution via Expression Engine
CVE-2026-100865 8.8 HIGH Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
CVE-2026-100858 6.8 MEDIUM heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
CVE-2026-101050 6.5 MEDIUM Heym before 0.0.53 Authentication Bypass via Telegram Webhook
CVE-2026-101049 6.5 MEDIUM Heym before 0.0.53 Slack Webhook Signature Verification Bypass
CVE-2026-100859 6.5 MEDIUM Heym before 0.0.106 Credential Exfiltration via URL Override
CVE-2026-100860 5.5 MEDIUM heym before 0.0.105 Authentication Bypass via Redis Node
CVE-2026-100861 5.0 MEDIUM heym before 0.0.105 SSRF via credential-controlled base URLs
CVE-2026-100862 4.9 MEDIUM heym before 0.0.91 Multiple Secrets Plaintext Storage

IV. Related Vulnerabilities

Same product: heym
Same vendor: heymrun
Same weakness: CWE-918

V. Comments for CVE-2026-100863

No comments yet

Leave a comment