Heym vulnerabilities
3 known CVE vulnerabilities in Heym, translated and rated.
- CVE-2026-45227High
Heym before version 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor. Authenticated workflow authors can bypass sandbox restrictions using object-graph introspection primitives.
- CVE-2026-45226High
Heym before version 0.0.21 contains an authorization bypass vulnerability in workflow execution. An authenticated attacker can execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation.
- CVE-2026-45225High
A path traversal vulnerability in Heym before version 0.0.21 allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. The flaw exists in the file upload endpoint where the filename parameter is not properly validated.