EUVD-2026-69295
GHSA-488w-5jv5-7w7q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network SSRF that crosses to internal services warrants S:C; PR:L reflects required workflow-authoring account; no availability impact on either system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
AnalysisAI
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the Heym instance with permission to create or modify workflow nodes (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 5.3 (Medium) appropriately reflects the authenticated, limited-impact nature of the flaw: PR:L confirms a valid user account is required, and VC:L/VI:L captures read-and-write access to internal services without full system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Heym v0.0.98 or later, which extends the SSRF egress guard to WebSocket Send and WebSocket Trigger nodes (patch commit 540aade7c7495295062f32f4dfd0d6805f066f0c; release at https://github.com/heymrun/heym/releases/tag/v0.0.98). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to b
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run w
Arbitrary file write (and read/delete) in Heym before 0.0.21 lets an authenticated user escape the intended upload stora
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today