Skip to content
OpenAdvisories

Vendor

heyform

6 known vulnerabilities.

Products

heyform 6
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.8
    CVE-2026-63428

    HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` a…

    heyform heyform
  • Medium 6.4
    CVE-2026-45797

    HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

    HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by E…

    heyform heyform