CVE-2026-105396: fallo de gravedad media en heymrun heym
Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.1%
probabilidad de explotación
0.1%top 99% de las CVE
explotación observada
noninguna fuente lo reporta
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
heymrun · heymCVEs relacionadas — heymrun heym
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.7%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.5%CVE-2026-45226HIGHHeym < 0.0.21 Authorization Bypass in Workflow ExecutionEPSS 0.5%CVE-2026-45227HIGHHeym < 0.0.21 Sandbox Escape via Python IntrospectionEPSS 0.4%CVE-2026-84207MEDIUMHeym before 0.0.98 SSRF via WebSocket endpointsEPSS 0.3%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.3%