HeyForm CVE-2026-35198

Requires an authenticated low-privileged team member (PR:L) who can create or edit form content within a shared team, and requires the higher-privileged team owner to subsequently view/open the attacker-crafted form (UI:R) for the stored payload to execute. Exploitation is limited to multi-user/team deployments where lower-trust members are granted form-authoring access; a single-owner instance with no untrusted collaborators is not exposed. The concrete injection vectors fixed are unescaped rich-text schema text and attribute values, the permissive 'style' attribute, and dangerous href URL protocols (javascript:, vbscript:, data:) in the answer-utils HTML serializer and form-renderer blocks.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) shows a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L, i.e. an existing team member) and victim interaction (UI:R, the owner must open the form), with a scope change (S:C) reflecting that code executes in a different, higher-privileged security context. That combination is internally consistent with the description of stored XSS leading to privilege escalation. Real-world risk is tempered by two limiting factors: the attacker must already be a member of the target team, and exploitation only triggers when the owner views the malicious form. There is no CISA KEV listing and EPSS was not provided, and no public exploit code was identified, so this is not evidence of active mass exploitation; however the source-code evidence is public, lowering the bar to reproduce. Net: a genuine high-priority issue for any multi-tenant/team HeyForm deployment where untrusted or lower-trust members can author form content, but not an unauthenticated internet-wide worming risk.

A low-privileged member of a HeyForm team edits a form and inserts a rich-text/link element carrying a malicious payload (e.g. an event-handler attribute or a javascript:/data: href, or unescaped markup that breaks out of an attribute). The payload is stored and, when the team owner later opens that form in the builder or renderer, the script executes in the owner's authenticated session and is used to steal session tokens or perform privileged actions, escalating to full account takeover. No public exploit code is identified, but the fix commit and its test cases illustrate the exact injection patterns.