CVE-2026-100865 — Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit wor…
Published: 2026-09-27 · CVSS: 8.7 · CVSS 4.0
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7