Threats tagged 'ghsa-gxgj-2794-2q5v'

heym versions prior to 0.0.91 have a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver. This flaw allows authenticated users to execute arbitrary Python code by exploiting dunder attribute access to reach os.system and run commands as the backend process.