Heym
Monthly
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to break out of the restricted execution environment using Python object-graph introspection, recover the unrestricted __import__ function, and load blocked modules such as os and subprocess. Once free of the sandbox, an attacker executes arbitrary host commands as the backend service user and reads inherited environment variables holding database credentials and encryption keys. Publicly available exploit code exists (SSVC 'poc'), though the EPSS probability is very low at 0.04% and it is not listed in CISA KEV.
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run workflows belonging to other users by referencing the victim's workflow UUIDs, exposing their outputs and triggering side-effecting nodes. The root cause is missing access validation on subworkflow and execute-node references (CWE-863), fixed upstream in pull request #93. No public exploit has been identified at time of analysis, and EPSS scores it at just 0.05% with CISA SSVC marking exploitation as 'none' - but SSVC rates the technical impact as total.
Arbitrary file write (and read/delete) in Heym before 0.0.21 lets an authenticated user escape the intended upload storage directory by embedding directory-traversal sequences in the filename parameter of the upload_file() handler. Because the filename is never validated, an attacker with valid credentials can plant, overwrite, or remove files anywhere the service account can reach, potentially leading to code execution or data tampering. Publicly available exploit code exists per SSVC (POC), but EPSS is very low (0.04%, 11th percentile) and it is not on CISA KEV, indicating no confirmed widespread exploitation.
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. No public exploit has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available as v0.0.98.
Sandbox escape in Heym's custom Python tool executor (versions before 0.0.21) allows authenticated workflow authors to break out of the restricted execution environment using Python object-graph introspection, recover the unrestricted __import__ function, and load blocked modules such as os and subprocess. Once free of the sandbox, an attacker executes arbitrary host commands as the backend service user and reads inherited environment variables holding database credentials and encryption keys. Publicly available exploit code exists (SSVC 'poc'), though the EPSS probability is very low at 0.04% and it is not listed in CISA KEV.
Authorization bypass in Heym's workflow execution engine (versions before 0.0.21) allows any authenticated user to run workflows belonging to other users by referencing the victim's workflow UUIDs, exposing their outputs and triggering side-effecting nodes. The root cause is missing access validation on subworkflow and execute-node references (CWE-863), fixed upstream in pull request #93. No public exploit has been identified at time of analysis, and EPSS scores it at just 0.05% with CISA SSVC marking exploitation as 'none' - but SSVC rates the technical impact as total.
Arbitrary file write (and read/delete) in Heym before 0.0.21 lets an authenticated user escape the intended upload storage directory by embedding directory-traversal sequences in the filename parameter of the upload_file() handler. Because the filename is never validated, an attacker with valid credentials can plant, overwrite, or remove files anywhere the service account can reach, potentially leading to code execution or data tampering. Publicly available exploit code exists per SSVC (POC), but EPSS is very low (0.04%, 11th percentile) and it is not on CISA KEV, indicating no confirmed widespread exploitation.
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. No public exploit has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available as v0.0.98.