EUVD-2026-45983Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery with no auth or complexity, but victim interaction required; scope changes to browser context with low confidentiality/integrity impact typical of stored XSS.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
AnalysisAI
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitrary JavaScript in victims' browsers by uploading SVG files containing embedded scripts. The /api/upload endpoint accepted SVG uploads without authentication, stored them in the static assets directory, and Express's serve-static served them with Content-Type: image/svg+xml, enabling script execution in the HeyForm domain context when a victim views the file URL. No active exploitation is confirmed (not in CISA KEV); vendor-released patch 3.0.0-rc.7 is available.
Technical ContextAI
HeyForm is a Node.js/TypeScript form-builder application using Express.js as its HTTP server and Multer for multipart file handling. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is twofold: first, image/svg+xml was present in the commonFileMimeTypes allowlist in packages/utils/src/mime.ts, permitting SVG uploads through the Multer filter; second, the serve-static middleware served uploaded files directly from the static assets directory with their natural MIME type and no X-Content-Type-Options: nosniff header. SVG is an XML-based vector format that natively supports embedded JavaScript via <script> elements and inline event handlers; when served with Content-Type: image/svg+xml in a browser, it is parsed and executed as active content - functionally equivalent to HTML from a script-execution standpoint. CPE cpe:2.3:a:heyform:heyform:*:*:*:*:*:*:*:* covers all versions prior to the fix.
RemediationAI
Upgrade HeyForm to version 3.0.0-rc.7 or later, which contains the vendor patch (commit 144240e5545d10fd9e120d05ccb402a6d7064674). The fix applies a defense-in-depth approach: upload.controller.ts now maintains a blocklist rejecting .svg and .svgz file extensions and image/svg+xml/application/svg+xml MIME types at upload time; a dedicated Express middleware intercepts requests to /static/upload and returns HTTP 403 for any SVG or SVGZ path before serve-static processes them; SVG was removed from the allowed extensions for the upload static route; and X-Content-Type-Options: nosniff was added to upload-served responses. If immediate patching is not possible, a compensating control is to configure an upstream reverse proxy (e.g., nginx) to block all POST requests to /api/upload from unauthenticated sessions - note this disables the upload feature entirely. Alternatively, configuring the proxy to inject Content-Disposition: attachment on all responses from the upload path forces downloads rather than inline rendering, reducing but not eliminating XSS risk (some browsers still parse SVG as active content when opened directly). Neither workaround replaces the upstream patch. Advisory: https://github.com/heyform/heyform/security/advisories/GHSA-m94h-jxvc-hhch.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team memb
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logge
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today