EUVD-2026-87823
GHSA-68x6-m7x2-mcgw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any registered user (PR:L) can trivially trigger it with no interaction (AC:L/UI:N); non-blind read of internal/metadata endpoints gives C:H, limited internal request-side effects I:L, no A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials (webhook_url / flaresolverr_url) using an unguarded HTTP client, bypassing the SSRF egress guard that already protects the HTTP, WebSocket, and MCP nodes; the credential API validates only that the URL is non-empty. Any registered user can create a credential pointing at an internal address and execute a workflow, causing the backend to reach loopback, private, link-local, or cloud-metadata endpoints and return the full response body in the node output (non-blind SSRF).
AnalysisAI
Non-blind server-side request forgery in heym (heymrun) before 0.0.109 lets any registered user redirect backend HTTP requests to loopback, private, link-local, or cloud-metadata addresses and read the full response body in the workflow node output. The flaw is confined to the Slack, Discord, and Crawler workflow nodes, which build requests from user-supplied credential URLs (webhook_url / flaresolverr_url) with an unguarded HTTP client that bypasses the SSRF egress guard already enforced on the HTTP, WebSocket, and MCP nodes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a registered/authenticated account on a heym instance running a version before 0.0.109 (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade heym to version 0.0.109 or later, which applies the SSRF egress guard to the Slack, Discord, and Crawler nodes so that credential-supplied webhook_url and flaresolverr_url values cannot reach loopback, private, link-local, or cloud-metadata addresses; consult the vendor advisory at https://github.com/heymrun/heym/security/advisories/GHSA-39j3-6x3x-8rcr for the exact release artifacts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every heym (heymrun) instance and confirm its running version, treating anything below 0.0.109 as affected; immediately block outbound traffic from those hosts to loopback, RFC1918, link-local and cloud metadata addresses (for example 169.254.169.254 and fd00:ec2::254), and where that is not feasible disable the Slack, Discord, and Crawler workflow nodes or restrict node authoring to trusted administrators, then review workflow node output and egress/proxy logs for requests to internal or metadata addresses originating from those three node types. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Sandbox escape in the heym workflow platform before 0.0.91 allows an authenticated user who can author or edit workflow
Python eval()-based remote code execution in Heym (heymrun/heym) before 0.0.53 lets an authenticated user who can edit a
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to b
Heym deployments prior to 0.0.53 leave their Telegram webhook endpoints without verification of the X-Telegram-Bot-Api-S
Forged Slack webhook events can trigger Heym workflows with the owner's credentials because Heym before 0.0.53 skips Sla
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run w
Arbitrary file write (and read/delete) in Heym before 0.0.21 lets an authenticated user escape the intended upload stora
Credential exfiltration in Heym before version 0.0.106 allows an authenticated collaborator who has been granted shared
Cleartext storage and over-exposure of multiple capability secrets in Heym, a workflow automation platform, affects all
heym before 0.0.105 fails to enforce credential authorization in its Redis workflow node, letting an authenticated workf
Server-side request forgery in Heym 0.0.90 and earlier lets a caller-controlled workflow input steer an outbound HTTP fe
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network servi
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today