CVE-2026-35198
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.
Risk Assessment
An attacker can take over the team owner's account, gaining full access to all forms and data.
Recommendation
Update HeyForm to version 3.0.0-rc.7 or later, which contains a patch.
Other vulnerabilities in HeyForm
See all- CVE-2026-82291High
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
- CVE-2026-63429High
Vulnerability in HeyForm before version 3.0.0-rc.9: the POST /api/upload endpoint lacks authentication and form-context validation. Any anonymous user can upload a file (up to 10 MB) and receive a public URL.
- CVE-2026-63428Medium
HeyForm before version 3.0.0-rc.9 does not properly validate `hiddenFields` submitted by users. An anonymous user can inject arbitrary key-value pairs, including XSS payloads, which are then forwarded to webhooks.
- CVE-2026-45797Medium
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Original NVD description (English source)
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.