CVE-2026-100864CWE-94code-injection

CVE-2026-100864

High · published September 27, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00686 · 52.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-27T06:17Z
References (3)
https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4 · [email protected]https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine · [email protected]https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 1%
    epss
  • 27 SEP 01:28Z
    heym before 0.0.91 Remote Code Execution via Expression Engine
    cvelistv5