Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by heyform
CVE-2026-82291 (GCVE-0-2026-82291)
Vulnerability from nvd – Published: 2026-08-28 16:19 – Updated: 2026-08-31 18:58
VLAI
EPSS
VEX
Title
HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
Summary
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:58 UTC
CWE
- CWE-942 - Permissive Cross-domain Security Policy with Untrusted Domains
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | vendor-advisory |
| https://github.com/heyform/heyform/blob/v3.0.0-rc… | technical-description |
| https://github.com/heyform/heyform/commit/bf9d738… | patch |
| https://github.com/heyform/heyform | product |
| https://www.vulncheck.com/advisories/heyform-refl… | third-party-advisory |
Impacted products
Date Public
2026-06-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82291",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:58:33.669103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:58:53.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"lessThan": "3.0.0-rc.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-942",
"description": "Permissive Cross-domain Security Policy with Untrusted Domains",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:48:21.218Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fg7j-rmgr-rc9g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g"
},
{
"name": "Vulnerable code: main.ts",
"tags": [
"technical-description"
],
"url": "https://github.com/heyform/heyform/blob/v3.0.0-rc.7/packages/server/src/main.ts"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4"
},
{
"tags": [
"product"
],
"url": "https://github.com/heyform/heyform"
},
{
"name": "VulnCheck Advisory: HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/heyform-reflects-any-origin-in-cors-responses-while-allowing-credentials"
}
],
"title": "HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82291",
"datePublished": "2026-08-28T16:19:07.930Z",
"dateReserved": "2026-08-28T11:12:54.442Z",
"dateUpdated": "2026-08-31T18:58:53.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63429 (GCVE-0-2026-63429)
Vulnerability from nvd – Published: 2026-07-20 15:54 – Updated: 2026-07-20 17:45
VLAI
EPSS
VEX
Title
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 17:45 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/092e255… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63429",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T17:45:12.280558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T17:45:35.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:54:22.075Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7"
},
{
"name": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2"
}
],
"source": {
"advisory": "GHSA-432x-54v2-p7p7",
"discovery": "UNKNOWN"
},
"title": "HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63429",
"datePublished": "2026-07-20T15:54:22.075Z",
"dateReserved": "2026-07-16T19:35:57.766Z",
"dateUpdated": "2026-07-20T17:45:35.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63428 (GCVE-0-2026-63428)
Vulnerability from nvd – Published: 2026-07-20 15:50 – Updated: 2026-07-20 16:13
VLAI
EPSS
VEX
Title
HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 16:11 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/092e255… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T16:11:40.127768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T16:13:26.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form\u0027s declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:50:14.065Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3"
},
{
"name": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2"
}
],
"source": {
"advisory": "GHSA-r7vg-xh87-v4w3",
"discovery": "UNKNOWN"
},
"title": "HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form\u0027s declared hidden-field set"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63428",
"datePublished": "2026-07-20T15:50:14.065Z",
"dateReserved": "2026-07-16T19:35:57.766Z",
"dateUpdated": "2026-07-20T16:13:26.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45797 (GCVE-0-2026-45797)
Vulnerability from nvd – Published: 2026-07-20 15:43 – Updated: 2026-07-20 19:07
VLAI
EPSS
VEX
Title
HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/144240e… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45797",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:01:36.295474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:07:52.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express\u0027s serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:43:13.473Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch"
},
{
"name": "https://github.com/heyform/heyform/commit/144240e5545d10fd9e120d05ccb402a6d7064674",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/144240e5545d10fd9e120d05ccb402a6d7064674"
}
],
"source": {
"advisory": "GHSA-m94h-jxvc-hhch",
"discovery": "UNKNOWN"
},
"title": "HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45797",
"datePublished": "2026-07-20T15:43:13.473Z",
"dateReserved": "2026-05-13T08:19:32.603Z",
"dateUpdated": "2026-07-20T19:07:52.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35198 (GCVE-0-2026-35198)
Vulnerability from nvd – Published: 2026-07-20 15:47 – Updated: 2026-08-21 19:58
VLAI
EPSS
VEX
Title
HeyForm vulnerable to stored XSS via form field titles
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/cc97d27… | x_refsource_MISC |
| https://vokecyber.com/research/cve-2026-35198-hey… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:01:46.436306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:02:26.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:58:19.726Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx"
},
{
"name": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3"
},
{
"name": "https://vokecyber.com/research/cve-2026-35198-heyform-stored-xss",
"tags": [
"x_refsource_MISC"
],
"url": "https://vokecyber.com/research/cve-2026-35198-heyform-stored-xss"
}
],
"source": {
"advisory": "GHSA-chmm-jqpm-3pwx",
"discovery": "UNKNOWN"
},
"title": "HeyForm vulnerable to stored XSS via form field titles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35198",
"datePublished": "2026-07-20T15:47:21.255Z",
"dateReserved": "2026-04-01T18:48:58.937Z",
"dateUpdated": "2026-08-21T19:58:19.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82291 (GCVE-0-2026-82291)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:19 – Updated: 2026-08-31 18:58
VLAI
EPSS
VEX
Title
HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
Summary
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:58 UTC
CWE
- CWE-942 - Permissive Cross-domain Security Policy with Untrusted Domains
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | vendor-advisory |
| https://github.com/heyform/heyform/blob/v3.0.0-rc… | technical-description |
| https://github.com/heyform/heyform/commit/bf9d738… | patch |
| https://github.com/heyform/heyform | product |
| https://www.vulncheck.com/advisories/heyform-refl… | third-party-advisory |
Impacted products
Date Public
2026-06-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82291",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:58:33.669103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:58:53.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"lessThan": "3.0.0-rc.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-942",
"description": "Permissive Cross-domain Security Policy with Untrusted Domains",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:48:21.218Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fg7j-rmgr-rc9g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g"
},
{
"name": "Vulnerable code: main.ts",
"tags": [
"technical-description"
],
"url": "https://github.com/heyform/heyform/blob/v3.0.0-rc.7/packages/server/src/main.ts"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4"
},
{
"tags": [
"product"
],
"url": "https://github.com/heyform/heyform"
},
{
"name": "VulnCheck Advisory: HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/heyform-reflects-any-origin-in-cors-responses-while-allowing-credentials"
}
],
"title": "HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82291",
"datePublished": "2026-08-28T16:19:07.930Z",
"dateReserved": "2026-08-28T11:12:54.442Z",
"dateUpdated": "2026-08-31T18:58:53.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63429 (GCVE-0-2026-63429)
Vulnerability from cvelistv5 – Published: 2026-07-20 15:54 – Updated: 2026-07-20 17:45
VLAI
EPSS
VEX
Title
HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 17:45 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/092e255… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63429",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T17:45:12.280558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T17:45:35.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoint is used by both authenticated form creators and unauthenticated form submitters; because no form-context binding exists, every request to it is anonymously accepted. Version 3.0.0-rc.9 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:54:22.075Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7"
},
{
"name": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2"
}
],
"source": {
"advisory": "GHSA-432x-54v2-p7p7",
"discovery": "UNKNOWN"
},
"title": "HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63429",
"datePublished": "2026-07-20T15:54:22.075Z",
"dateReserved": "2026-07-16T19:35:57.766Z",
"dateUpdated": "2026-07-20T17:45:35.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63428 (GCVE-0-2026-63428)
Vulnerability from cvelistv5 – Published: 2026-07-20 15:50 – Updated: 2026-07-20 16:13
VLAI
EPSS
VEX
Title
HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 16:11 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/092e255… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T16:11:40.127768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T16:13:26.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form\u0027s declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:50:14.065Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3"
},
{
"name": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2"
}
],
"source": {
"advisory": "GHSA-r7vg-xh87-v4w3",
"discovery": "UNKNOWN"
},
"title": "HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form\u0027s declared hidden-field set"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63428",
"datePublished": "2026-07-20T15:50:14.065Z",
"dateReserved": "2026-07-16T19:35:57.766Z",
"dateUpdated": "2026-07-20T16:13:26.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35198 (GCVE-0-2026-35198)
Vulnerability from cvelistv5 – Published: 2026-07-20 15:47 – Updated: 2026-08-21 19:58
VLAI
EPSS
VEX
Title
HeyForm vulnerable to stored XSS via form field titles
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:01 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/cc97d27… | x_refsource_MISC |
| https://vokecyber.com/research/cve-2026-35198-hey… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:01:46.436306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:02:26.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:58:19.726Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx"
},
{
"name": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3"
},
{
"name": "https://vokecyber.com/research/cve-2026-35198-heyform-stored-xss",
"tags": [
"x_refsource_MISC"
],
"url": "https://vokecyber.com/research/cve-2026-35198-heyform-stored-xss"
}
],
"source": {
"advisory": "GHSA-chmm-jqpm-3pwx",
"discovery": "UNKNOWN"
},
"title": "HeyForm vulnerable to stored XSS via form field titles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35198",
"datePublished": "2026-07-20T15:47:21.255Z",
"dateReserved": "2026-04-01T18:48:58.937Z",
"dateUpdated": "2026-08-21T19:58:19.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45797 (GCVE-0-2026-45797)
Vulnerability from cvelistv5 – Published: 2026-07-20 15:43 – Updated: 2026-07-20 19:07
VLAI
EPSS
VEX
Title
HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload
Summary
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 19:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/heyform/heyform/security/advis… | x_refsource_CONFIRM |
| https://github.com/heyform/heyform/commit/144240e… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45797",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T19:01:36.295474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:07:52.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "heyform",
"vendor": "heyform",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0-rc.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express\u0027s serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T15:43:13.473Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch"
},
{
"name": "https://github.com/heyform/heyform/commit/144240e5545d10fd9e120d05ccb402a6d7064674",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/heyform/heyform/commit/144240e5545d10fd9e120d05ccb402a6d7064674"
}
],
"source": {
"advisory": "GHSA-m94h-jxvc-hhch",
"discovery": "UNKNOWN"
},
"title": "HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45797",
"datePublished": "2026-07-20T15:43:13.473Z",
"dateReserved": "2026-05-13T08:19:32.603Z",
"dateUpdated": "2026-07-20T19:07:52.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}