CVE-2026-105396: falha de média gravidade em heymrun heym
Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.1%
probabilidade de exploração
0.1%top 99% das CVEs
exploração observada
nãonenhuma fonte reporta
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
heymrun · heymCVEs relacionadas — heymrun heym
No mesmo produto, das mais perigosas para as menos.
CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.7%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.5%CVE-2026-45226HIGHHeym < 0.0.21 Authorization Bypass in Workflow ExecutionEPSS 0.5%CVE-2026-45227HIGHHeym < 0.0.21 Sandbox Escape via Python IntrospectionEPSS 0.4%CVE-2026-84207MEDIUMHeym before 0.0.98 SSRF via WebSocket endpointsEPSS 0.3%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.3%