Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
heymrun:heym
References 3
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
GitHub Security Advisory (GHSA-pm6h-x3h5-j38h)
https://www.vulncheck.com/advisories/heym-before-0.0.53-multiple-rce-and-authen…
VulnCheck Advisory: Heym before 0.0.53 Multiple RCE and Authentication Bypass Vulnerabilities
https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
Patch Commit