The Heym platform is at the center of two new security bulletins, which describe a chain of issues with serious consequences for facilities running automated workflows. The vulnerabilities allow, depending on the entry point, code execution, bypassing checks, and reuse of sensitive tokens.
The first entry, CVE-2026-100865, concerns versions before 0.0.53 and has a CVSS score of 8.8 in 3.1 and 8.7 in 4.0. The CVEFeed entry reports multiple independent issues, not a single bug.
See also: OpenAI Codex: Two sandbox boundary violations
How vulnerabilities manifest themselves on the Heym platform
The workflow condition evaluator uses Python eval() without effective restriction. A user who can edit a branch or condition, or insert a malicious flow template, can cause the application to execute arbitrary Python with the privileges of the backend process.
The same CVE describes a fail-safe vulnerability in Slack and Telegram webhooks. When the credentialId or the signing secret is empty, verification fails to reject the request. Anyone who knows the public URL can then trigger flows that use the owner's credentials.
There is also a problem with the validation of redirect_uri in OAuth. The lack of schema checking allows the use of values such as javascript: or data: in a public client. Assuming the victim is redirected to the consent page, the attacker can influence the authorization flow within the Heym origin.
The listing also mentions plaintext storage for WorkflowExecutionToken, PortalSession, HITLRequest.public_token , and OAuth tokens. A database leak could reveal active tokens, while portal and HITL tokens have a lifespan of up to 168 hours and can be used to execute workflows.
The combination of findings is particularly concerning for teams hosting the tool on a shared server. The ability to import templates, automatically trigger webhooks, and connect to external services widen the attack surface. Even when users are considered trusted, an account with excessive privileges can turn a malicious flow into an entry point for the entire environment.
New sandbox escape and second entry
Separately, CVE-2026-100864 concerns the Heym platform before version 0.0.91. According to CVEFeed's analysis , an authenticated user can exploit the expression engine, DotList's map and filter functions, or the fallback resolver
The technique relies on accessing dunder attributes, so that the expression can reach functions such as os.system. The result is arbitrary command execution as the backend user. The CVE has a CVSS 3.1 score of 8.8 and CVSS 4.0 score of 8.7, with a patch version of 0.0.91 or later.
See also: Devtron: Critical vulnerability exposes API tokens and gives full control
The fixes in version 0.0.53 are also confirmed by Heym's report. It states that GHSA-pm6h-x3h5-j38h disabled sandbox escape in the condition evaluator, replacing it with an AST-based evaluator that blocks attribute traversal. The same release made Slack and Telegram webhooks fail safely when the verification is invalid.
What should administrators do?
The SecNews technical team recommends immediately upgrading Heym to a recent version, as moving only to 0.0.53 does not cover the second CVE. The official project page on GitHub lists version 0.0.113 as the latest release, so administrators should follow the upgrade instructions and required migrations.
After installation, rotate any secrets that may have been stored or returned in plain text. Check the URLs of Slack and Telegram webhooks, confirm that each trigger requires a valid signature, and restrict permissions to create or import workflows. Also, look for unusual executions and OAuth consents in the logs.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: n8n API Tokens Leak Reveals Live Cases of Credential Theft
The exposure is not limited to endpoint remediation. The Heym platform combines workflows, webhooks, OAuth, and tools running on the server, so a mistake at any of these levels can translate into access to the infrastructure. Upgrading, changing secrets, and checking logs should be treated as a single process.
