Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

heym — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in heym, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of Common Weakness Enumerations (CWE) associated with the heym vendor and its specific software products. It serves as a centralized repository for tracking security flaws that have been identified, reported, or remediated within the heym ecosystem, ensuring that security professionals and developers have access to consolidated data regarding potential risks. The collection includes various types of vulnerabilities such as cross-site scripting, authentication bypasses, injection flaws, and configuration errors, covering incidents and advisories from the inception of the product through to the present day. By organizing these findings by weakness type and release version, the page allows users to effectively track the heym vendor’s security advisory history and observe trends in how certain issues are addressed over time. Visitors can gain a deeper understanding of specific weakness classes by examining how they manifest within heym applications, facilitating better risk assessment and prioritization for security audits. Additionally, users can look up the complete vulnerability history for any heym product version, enabling them to evaluate the historical security posture and identify recurring patterns in code quality or design flaws. This resource is designed to support informed decision-making by providing transparent, searchable, and structured data without requiring external tools for initial discovery.

Vendor: heymrun

CVE ID Title CVSS Severity Published
CVE-2026-55376 heym Python Tool Sandbox Escape CWE-78 8.8 High 2026-10-13
CVE-2026-109362 Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens CWE-613 5.4 Medium 2026-10-12
CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header CWE-346 5.4 Medium 2026-10-05
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CWE-287 6.5 Medium 2026-09-27
CVE-2026-101049 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CWE-287 6.5 Medium 2026-09-27
CVE-2026-100865 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CWE-94 8.8 High 2026-09-27
CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation CWE-918 5.0 Medium 2026-09-27
CVE-2026-100864 heym before 0.0.91 Remote Code Execution via Expression Engine CWE-94 8.8 High 2026-09-27
CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage CWE-312 4.9 Medium 2026-09-27
CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs CWE-918 5.0 Medium 2026-09-27
CVE-2026-100860 heym before 0.0.105 Authentication Bypass via Redis Node CWE-636 5.5 Medium 2026-09-27
CVE-2026-100859 Heym before 0.0.106 Credential Exfiltration via URL Override CWE-918 6.5 Medium 2026-09-27
CVE-2026-100858 heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes CWE-918 6.8 Medium 2026-09-27
CVE-2026-84207 Heym before 0.0.98 SSRF via WebSocket endpoints CWE-918 5.4 Medium 2026-09-01
CVE-2026-45227 Heym < 0.0.21 Sandbox Escape via Python Introspection CWE-693 8.8 High 2026-05-12
CVE-2026-45226 Heym < 0.0.21 Authorization Bypass in Workflow Execution CWE-863 7.1 High 2026-05-12
CVE-2026-45225 Heym < 0.0.21 Path Traversal File Upload via upload_file() CWE-22 7.6 High 2026-05-12

All 17 known CVE vulnerabilities affecting heym with full Chinese analysis, references, and POCs where available.