CVE-2026-100864: heym Expression Engine RCE Vulnerability

CVE-2026-100864 Overview

CVE-2026-100864 is a sandbox escape vulnerability in the heym workflow engine affecting versions before 0.0.91. The flaw resides in the expression engine's DotList map/filter operations and the fallback resolver. Authenticated users can craft workflow expressions that leverage dunder attribute access through item expressions or the fallback resolver to reach os.system and execute arbitrary Python code. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can escape the expression sandbox and execute arbitrary operating system commands with the privileges of the heym backend process.

Affected Products

heym workflow engine versions prior to 0.0.91
Deployments exposing workflow expression authoring to authenticated users
Backend services running the vulnerable expression engine

Discovery Timeline

2026-09-27 - CVE-2026-100864 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100864

Vulnerability Analysis

The heym expression engine evaluates user-supplied workflow expressions in a sandbox intended to restrict access to Python internals. Two code paths break that sandbox. The DotList map and filter operators process item expressions without blocking dunder attribute access. The fallback resolver resolves unknown identifiers in a manner that also exposes dunder attributes. Together, these paths let an authenticated workflow author traverse Python object graphs from exposed values to class references, module globals, and ultimately os.system.

Once the attacker reaches os.system or an equivalent callable, the expression engine executes commands in the context of the backend process. This converts a workflow-authoring privilege into full remote code execution on the host.

Root Cause

The root cause is incomplete input filtering in two expression-evaluation surfaces. Both the DotList map/filter item expressions and the fallback resolver fail to block attribute names beginning and ending with double underscores. Python object introspection via __class__, __bases__, __subclasses__, and __globals__ remains reachable, which defeats the sandbox's allow-list intent.

Attack Vector

An authenticated user with permission to author or edit a workflow submits an expression that uses DotList map or filter semantics, or references an undefined identifier handled by the fallback resolver. The expression chains dunder attribute lookups to locate a reference to os and invokes system with an attacker-controlled command string. Execution occurs server-side when the workflow runs or when the expression is evaluated during validation.

For technical details and reproduction steps, see the GitHub Security Advisory GHSA-87x2-9jwx-7gh4 and the VulnCheck Advisory.

Detection Methods for CVE-2026-100864

Indicators of Compromise

Workflow expressions containing dunder attribute references such as __class__, __mro__, __subclasses__, or __globals__
Expression strings referencing os, system, subprocess, or popen within DotList map or filter arguments
Unexpected child processes spawned by the heym backend process, especially shells or command interpreters
Outbound network connections from the heym backend to attacker-controlled hosts following workflow execution

Detection Strategies

Inspect workflow definitions and expression history for dunder tokens and suspicious attribute chains
Enable audit logging on workflow creation, modification, and execution events to correlate authoring with command execution
Monitor process ancestry on hosts running heym to flag command interpreters descending from the backend

Monitoring Recommendations

Alert on process creation events where the parent is the heym backend and the child is sh, bash, cmd.exe, or powershell.exe
Forward application logs to a centralized analytics platform and build detections for dunder patterns in expression payloads
Track authenticated session activity for users with workflow-authoring privileges and review changes outside maintenance windows

How to Mitigate CVE-2026-100864

Immediate Actions Required

Upgrade heym to version 0.0.91 or later on all backend hosts
Audit existing workflows for malicious expressions before restoring service
Rotate credentials, API tokens, and secrets accessible to the heym backend process if compromise is suspected
Restrict workflow-authoring privileges to a minimal set of trusted users until patching is complete

Patch Information

The vendor fixed the issue in heym version 0.0.91. Review the GitHub Security Advisory GHSA-87x2-9jwx-7gh4 for upgrade guidance and the specific commits that harden the expression engine.

Workarounds

Remove or disable workflow-authoring permissions for non-administrative users until the upgrade is applied
Place the heym backend behind a network segmentation boundary that blocks outbound internet access
Run the heym backend as a least-privileged service account with no shell or package-manager access

bash

# Upgrade heym to the patched release
pip install --upgrade "heym>=0.0.91"

# Verify the installed version
python -c "import heym; print(heym.__version__)"