[ Vendor · 14 CVEs ]
heymrun
CVEs affecting heymrun published in the last 30 days, plus any heymrun CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110873 | 14 Oct 2026 | CVSS 7.1 | heymrun heymHeym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's… | |
| CVE-2026-55376 | 13 Oct 2026 | CVSS 8.8 | heymrun heymHeym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can… | |
| CVE-2026-109362 | 12 Oct 2026 | CVSS 5.4 | heymrun heymHeym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by… | |
| CVE-2026-105396 | 5 Oct 2026 | CVSS 5.4 | heymrun heymHeym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review… | |
| CVE-2026-101050 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or… | |
| CVE-2026-101049 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote… | |
| CVE-2026-100863 | 27 Sep 2026 | CVSS 5.0 | heymrun heymHeym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91… | |
| CVE-2026-100864 | 27 Sep 2026 | CVSS 8.8 | heymrun heymheym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows… | |
| CVE-2026-100865 | 27 Sep 2026 | CVSS 8.8 | heymrun heymHeym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service… | |
| CVE-2026-100858 | 27 Sep 2026 | CVSS 6.8 | heymrun heymheym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP… | |
| CVE-2026-100859 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared… | |
| CVE-2026-100860 | 27 Sep 2026 | CVSS 5.5 | heymrun heymheym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node… | |
| CVE-2026-100861 | 27 Sep 2026 | CVSS 5.0 | heymrun heymheym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to… | |
| CVE-2026-100862 | 27 Sep 2026 | CVSS 4.9 | heymrun heymheym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets… |