HeyForm Stored XSS Vulnerability (CVE-2026-35198) Advisory and Remediation Guide

Vulnerability Overview CVE-2026-35198: Stored XSS in HeyForm Rich Text Fields — Team Takeover via Silent Payloads HeyForm's form builder supports rich text fields that store HTML in the form schema. These fields are rendered via / without any sanitization. Any team member with form editing permissions can inject a persistent JavaScript payload that will execute automatically in any browser rendering the form—including the form owner (in the builder), anonymous respondents (in public forms), and team members (in the response dashboard). The payload enables silent session theft and complete takeover of team ownership. The fix was released in commit , but no public advisory was issued; no Dependabot alerts were triggered; and there is no NVD record. Impact Scope Affected Versions: All versions up to v3.0.0-rc.6 Severity: Critical (CVSS v3.1 Base Score 9.0) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:A:N Weaknesses: - CWE-79 — Stored Cross-Site Scripting (Primary) - CWE-116 — Incorrect Encoding of Output Remediation Fix Commit: , message: “Fix stored XSS in form schema rich text,” which applies input sanitization to HTML content before DOM insertion, preventing arbitrary script injection via rich text fields. Important Note: No tagged release notes document this fix. Cloud deployments automatically push the fix to Heyform.net. Self-hosted operators must manually check and commit updates. Remediation for Self-Hosted Operators 1. Verify the presence of commit : In your HeyForm deployment directory, run . If absent, the instance is vulnerable. 2. Update to this commit immediately: Pull the latest codebase and rebuild. Treat this as a critical security update, regardless of other changes in the update. 3. Do not host public forms on unpatched instances: Any team member with form editing permissions can implant persistent payloads, allowing them to manipulate any form completed by anonymous respondents. 4. Review team member and form editing permissions: Before patching, any team member represents a potential attack vector. Minimize the number of team members to the least necessary. 5. Check for signs of exploitation: Review session logs for unexpected logins from anomalous locations. Look for unauthorized transfer of team ownership or new accounts at the owner level. Disclosure Timeline 2026-03-28: Vulnerability discovered during source code audit of heyform/heyform. Reproduced on a local v3.0.0-rc.6 instance. Confirmed full attack chain. 2026-03-30: GitHub Security Advisory GHSA-chmm-jqpm-3pxw submitted. 2026-04-02: GitHub assigned CVE-2026-35198. 2026-05-14: Follow-up comment posted with the expected advisory (6.5 weeks after report). Maintainer (IMuFeng) fixed the issue and closed the advisory thread in commit . No advisory was published. CVE was not pushed to cve.org. 2026-05-23: Follow-up comment requesting publishing steps. No response. 2026-06-10: Email sent to GitHub Security Lab. They confirmed they can push the CVE record once they receive the public-facing advisory URL. 2026-06-22: Published the advisory. Provided the URL to GitHub Security Lab to enable CVE record publication on cve.org. References GitHub Security Advisory: GHSA-chmm-jqpm-3pxw Fix Commit: — “Fix stored XSS in form schema rich text” HeyForm Repository: github.com/heyform/heyform Blog Post (Story and Disclosure Narrative): CVE-2026-35198: HeyForm’s Stored XSS Has Been Fixed. The Advisory Was Then Closed Without Publication. Code Snippet

Goal Reached Thanks to every supporter — we hit 100%!

HeyForm Stored XSS Vulnerability (CVE-2026-35198) Advisory and Remediation Guide