CVE-2026-105396: medium-severity vulnerability in heymrun heym
Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.1%
exploitation probability
0.1%top 99% of all CVEs
observed exploitation
nono source reports it
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
heymrun · heymRelated CVEs — heymrun heym
In the same product, most dangerous first.
CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.7%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.5%CVE-2026-45226HIGHHeym < 0.0.21 Authorization Bypass in Workflow ExecutionEPSS 0.5%CVE-2026-45227HIGHHeym < 0.0.21 Sandbox Escape via Python IntrospectionEPSS 0.4%CVE-2026-84207MEDIUMHeym before 0.0.98 SSRF via WebSocket endpointsEPSS 0.3%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.3%