CVE-2026-84207mediumCWE-918

CVE-2026-84207: falha de média gravidade em heymrun heym

Heym before 0.0.98 SSRF via WebSocket endpoints

Publicada em

Seguir esta CVE+ Monitorar heym

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
heymrun · heym
CVEs relacionadas — heymrun heym

No mesmo produto, das mais perigosas para as menos.

CVE-2026-100864HIGHheym before 0.0.91 Remote Code Execution via Expression EngineEPSS 0.9%CVE-2026-55376HIGHheym Python Tool Sandbox EscapeEPSS 0.5%CVE-2026-100865HIGHHeym before 0.0.53 Remote Code Execution via eval() Sandbox EscapeEPSS 0.4%CVE-2026-101050HIGHHeym before 0.0.53 Authentication Bypass via Telegram WebhookEPSS 0.4%CVE-2026-101049HIGHHeym before 0.0.53 Slack Webhook Signature Verification BypassEPSS 0.4%CVE-2026-45225HIGHHeym < 0.0.21 Path Traversal File Upload via upload_file()EPSS 0.4%