EUVD-2026-45984Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Authenticated low-priv member (PR:L) stores script that runs when owner views form (UI:R) in a higher-privilege context (S:C), enabling account takeover (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.
AnalysisAI
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.
Technical ContextAI
HeyForm is an open-source form builder; the affected component is its shared answer/HTML rendering layer (packages/answer-utils/src/html-utils.ts and packages/form-renderer/src/blocks/Block.tsx). The root cause is CWE-79 (improper neutralization of input during web page generation): the serializer emitted user-controlled rich-text schema nodes and attribute values without HTML-escaping, and its allowlist permitted a permissive 'style' attribute and did not filter dangerous href URL protocols. The patch adds escapeText()/escapeAttribute() helpers, removes 'style' from allowed attributes, and introduces a UNSAFE_URL_PROTOCOL_REGEX (/^\s*(?:javascript|vbscript|data):/i) that strips javascript:, vbscript:, and data: href values, plus a purge routine that drops unsafe tags and event handlers such as onerror/onclick. Because the malicious content is stored and later rendered in a higher-privileged user's authenticated session, the executing script inherits the victim's DOM, tokens, and application privileges. CPE cpe:2.3:a:heyform:heyform:*:*:*:*:*:*:*:* identifies the affected product.
RemediationAI
Vendor-released patch: upgrade to HeyForm 3.0.0-rc.7, which escapes serialized text and attributes, removes the 'style' attribute from the allowlist, blocks javascript:/vbscript:/data: href protocols, and purges unsafe tags and event-handler attributes; details are in advisory https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx and commit cc97d27a57ae400fec23abf5dcf6f9533c3b5db3. Because 3.0.0-rc.7 is a release candidate, validate it in staging before production rollout. If immediate upgrade is not possible, reduce exposure by tightening who can author form content: restrict form-builder/edit privileges to trusted members, review and vet forms created by lower-trust team members before an owner opens them, and consider fronting the app with a Content-Security-Policy that disallows inline script execution to blunt injected JavaScript - noting CSP may break legitimate inline behaviors and must be tested. These are compensating controls only and do not close the underlying sanitization gap.
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logge
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitra
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today