Heyform
Monthly
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logged-in user to make fully authenticated GraphQL API requests against the HeyForm server. The server's default CORS configuration (`origin: true, credentials: true`) unconditionally echoed the request Origin header back as `Access-Control-Allow-Origin` while also asserting `Access-Control-Allow-Credentials: true`, defeating the browser's same-origin policy for all origins. This exposes workspaces, projects, forms, submissions, and respondent data to exfiltration and permits account settings modification; no public exploit has been identified at time of analysis.
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB (PDF, Office docs, CSV, MP4, images, etc.) and receive a permanent, public URL hosted on the HeyForm domain. The endpoint is shared by authenticated form creators and unauthenticated submitters but performs no auth guard, no form-context binding, no openToken check, and no session validation, so every request is accepted anonymously in all deployments prior to 3.0.0-rc.9. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; abuse is trivial but limited to unauthorized file hosting rather than server compromise.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validation and store arbitrary key/value pairs - including XSS payloads and forged authorization metadata - directly into submission records. All HeyForm deployments prior to version 3.0.0-rc.9 are affected. The injected data is subsequently forwarded verbatim to every registered webhook integration, enabling downstream system poisoning and stored XSS against any admin interface that renders submission data. SSVC rates this as automatable with a POC exploit available; no KEV listing at time of analysis.
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitrary JavaScript in victims' browsers by uploading SVG files containing embedded scripts. The `/api/upload` endpoint accepted SVG uploads without authentication, stored them in the static assets directory, and Express's serve-static served them with `Content-Type: image/svg+xml`, enabling script execution in the HeyForm domain context when a victim views the file URL. No active exploitation is confirmed (not in CISA KEV); vendor-released patch 3.0.0-rc.7 is available.
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logged-in user to make fully authenticated GraphQL API requests against the HeyForm server. The server's default CORS configuration (`origin: true, credentials: true`) unconditionally echoed the request Origin header back as `Access-Control-Allow-Origin` while also asserting `Access-Control-Allow-Credentials: true`, defeating the browser's same-origin policy for all origins. This exposes workspaces, projects, forms, submissions, and respondent data to exfiltration and permits account settings modification; no public exploit has been identified at time of analysis.
Missing authentication in HeyForm's POST /api/upload endpoint lets any anonymous internet user upload files up to 10 MB (PDF, Office docs, CSV, MP4, images, etc.) and receive a permanent, public URL hosted on the HeyForm domain. The endpoint is shared by authenticated form creators and unauthenticated submitters but performs no auth guard, no form-context binding, no openToken check, and no session validation, so every request is accepted anonymously in all deployments prior to 3.0.0-rc.9. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; abuse is trivial but limited to unauthorized file hosting rather than server compromise.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validation and store arbitrary key/value pairs - including XSS payloads and forged authorization metadata - directly into submission records. All HeyForm deployments prior to version 3.0.0-rc.9 are affected. The injected data is subsequently forwarded verbatim to every registered webhook integration, enabling downstream system poisoning and stored XSS against any admin interface that renders submission data. SSVC rates this as automatable with a POC exploit available; no KEV listing at time of analysis.
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitrary JavaScript in victims' browsers by uploading SVG files containing embedded scripts. The `/api/upload` endpoint accepted SVG uploads without authentication, stored them in the static assets directory, and Express's serve-static served them with `Content-Type: image/svg+xml`, enabling script execution in the HeyForm domain context when a victim views the file URL. No active exploitation is confirmed (not in CISA KEV); vendor-released patch 3.0.0-rc.7 is available.