Vendor
heymrun
25 known vulnerabilities.
Products
13 results · Clear filters · Feed
-
High 8.8
Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the …
-
High 7.4
Heym: Server-Side Request Forgery (SSRF) in HTTP Workflow Node
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address…
-
High 8.8
Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is writt…
-
High 8.8
Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (python_tool_executor.py) treats user code as untr…
-
High 7.1
Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated user reaches local/private URLs through the SSE and streamable-HTTP transports
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker…
-
High 8.1
Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember …
-
High 7.1
Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field
Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to…
-
High 8.8
heym Python Tool Sandbox Escape
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/ap…
-
High 8.8
heym before 0.0.91 Remote Code Execution via Expression Engine
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute ac…
-
High 8.8
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python an…
-
High 8.8
Heym < 0.0.21 Sandbox Escape via Python Introspection
Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection tech…
-
High 7.1
Heym < 0.0.21 Authorization Bypass in Workflow Execution
Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with e…
-
High 7.6
Heym < 0.0.21 Path Traversal File Upload via upload_file()
Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit th…