CVE-2026-63428
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
HeyForm before version 3.0.0-rc.9 does not properly validate `hiddenFields` submitted by users. An anonymous user can inject arbitrary key-value pairs, including XSS payloads, which are then forwarded to webhooks.
Risk Assessment
An attacker can inject malicious data into stored submissions, which may then be executed in the context of webhook integrations, leading to data theft or further attacks.
Recommendation
Upgrade HeyForm to version 3.0.0-rc.9 or later.
Other vulnerabilities in HeyForm
See all- CVE-2026-35198Critical
HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.
- CVE-2026-82291High
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
- CVE-2026-63429High
Vulnerability in HeyForm before version 3.0.0-rc.9: the POST /api/upload endpoint lacks authentication and form-context validation. Any anonymous user can upload a file (up to 10 MB) and receive a public URL.
- CVE-2026-45797Medium
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Original NVD description (English source)
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue.