high8.8
CVE-2026-100865
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service.
Impact
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.
Affected products
| Product | Affected versions |
|---|---|
| Heym | before 0.0.53 |
Versions were read from the advisory text. No structured product data has been published for this record yet.