Threats affecting pkg:github/heymrun/heym

Heym versions from 0.0.55 up to but not including 0.0.121 contain a privilege escalation vulnerability. Shared collaborators can overwrite a workflow's error_workflow_id because this field is not restricted to owners only. This allows attackers to redirect error workflows to their own workflows containing HTTP nodes, leading to exfiltration of the owner's decrypted credentials when the parent workflow errors.

CVE-2026-55376 is a high-severity OS command injection vulnerability in heymrun's heym product prior to version 0.0.40. Authenticated users with permissions to create or edit workflows using an Agent custom Python tool can bypass sandbox restrictions due to improper validation of imported standard-library modules. This allows execution of arbitrary OS commands and file operations with the backend application user's privileges. The issue is fixed in version 0.0.40.

Heym versions from 0.0.5 up to but not including 0.0.113 have a broken access control vulnerability that allows former collaborators to continue executing JWT-authenticated workflows by reusing scoped workflow:execute tokens after their share has been removed. These tokens can have a time-to-live (TTL) of up to 10 years, cannot be listed or revoked by the owner, and enable repeated execution of workflows using shared credentials.

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.

CVE-2026-101050 is an improper authentication vulnerability in heymrun's heym software versions before 0.0.53. The flaw occurs because the software fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. This allows remote unauthenticated attackers to post forged Telegram updates, triggering workflows with the owner's configured credentials and potentially executing actions based on attacker-supplied input.

Heym versions before 0.0.53 contain an improper authentication vulnerability where Slack request signatures are not verified if trigger nodes lack credential IDs or have empty signing secrets. This allows remote unauthenticated attackers to send forged Slack events to known webhook URLs, potentially triggering workflows with the owner's credentials.

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.