CVE-2026-84207: medium-severity vulnerability in heymrun heym
Heym before 0.0.98 SSRF via WebSocket endpoints
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
heymrun · heymRelated CVEs — heymrun heym
In the same product, most dangerous first.
CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.9%CVE-2026-55376HIGHheym Python Tool Sandbox EscapeEPSS 0.5%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.4%CVE-2026-101050HIGHHeym before 0.0.53 Authentication Bypass via Telegram WebhookEPSS 0.4%CVE-2026-101049HIGHHeym before 0.0.53 Slack Webhook Signature Verification BypassEPSS 0.4%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.4%
References
https://github.com/heymrun/heymhttps://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.pyhttps://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.pyhttps://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0chttps://github.com/heymrun/heym/releases/tag/v0.0.98https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints