CVE-2026-100865: Heym Workflow RCE Vulnerability

CVE-2026-100865 Overview

CVE-2026-100865 is a code injection vulnerability [CWE-94] affecting Heym versions prior to 0.0.53. The workflow executor service evaluates workflow condition expressions using Python's eval() function with insufficient sandboxing. Authenticated users who can edit workflow condition nodes or import workflow templates can execute arbitrary Python code and operating system commands as the backend process user. The flaw allows an attacker with low privileges to achieve full compromise of the backend application context.

Critical Impact
Authenticated attackers can execute arbitrary Python and OS commands as the backend process user by crafting malicious workflow condition expressions or importing hostile workflow templates.

Affected Products

Heym versions prior to 0.0.53
Heym workflow executor service component
Backend API services bundled with Heym (including backend/app/api/slack.py and backend/app/api/telegram.py referenced in the fix)

Discovery Timeline

2026-09-27 - CVE-2026-100865 published to the National Vulnerability Database
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100865

Vulnerability Analysis

Heym implements workflow conditional branching by passing user-controlled condition expressions directly to Python's built-in eval() function. The workflow executor service applies insufficient sandboxing around this call. Python's eval() without a restricted execution environment exposes the full builtins namespace, including __import__, open, and exec. An attacker can traverse Python object attributes such as __class__.__mro__ and __subclasses__ to reach arbitrary classes and construct OS command execution primitives. Exploitation requires only an authenticated low-privilege account.

Root Cause

The root cause is unsafe dynamic code evaluation [CWE-94]. The workflow executor accepts condition expressions from workflow definitions and evaluates them without an allowlist of permitted operators, functions, or variable names. Workflow condition nodes and imported workflow templates are both authoritative sources of these expressions, so any user with the ability to edit a workflow or trigger an import of a crafted template can inject code. The backend process executes the payload with its own operating system privileges.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with permission to edit workflows submits a condition expression containing a Python payload. When the workflow runs, the executor evaluates the expression and the payload is executed by the Python interpreter. Importing a malicious workflow template produces the same outcome without the attacker needing direct access to the editor. Related webhook trigger paths were also hardened in the same release.

python

# Patch excerpt - backend/app/api/slack.py
if trigger_node:
    credential_id = trigger_node.get("data", {}).get("credentialId") or None

# SECURITY: Slack webhook signature verification must fail closed.
# See security advisory GHSA-pm6h-x3h5-j38h, finding H1. Previously, a missing
# credential_id or empty signing_secret caused verification to be skipped
# entirely, allowing anyone with the webhook URL to trigger the workflow with
# the owner's credentials.
#
# Client-facing error is a single generic message so probing the webhook URL
# does not reveal which nodes are misconfigured. The specific reason is logged
# server-side only.

Source: GitHub Commit 341d1012

Detection Methods for CVE-2026-100865

Indicators of Compromise

Workflow condition nodes containing Python dunder attribute references such as __class__, __mro__, __subclasses__, __builtins__, or __import__
Unexpected child processes spawned by the Heym backend process (for example sh, bash, python, curl, or wget)
Workflow template imports from untrusted sources immediately preceding anomalous backend process activity
Outbound network connections from the Heym backend host to attacker-controlled infrastructure

Detection Strategies

Audit stored workflow definitions for condition expressions that contain function calls, imports, or attribute traversal patterns not required by legitimate business logic
Monitor the Heym backend process tree for child processes outside the expected Python runtime behavior
Alert on authenticated API calls that create or modify workflow condition nodes with payloads exceeding normal size or containing suspicious tokens

Monitoring Recommendations

Enable application-level logging for workflow edits, template imports, and workflow executions, and ship the logs to a centralized SIEM
Correlate workflow modification events with subsequent process execution and outbound network telemetry from the backend host
Track webhook trigger activity on /slack and /telegram endpoints for requests that lack valid signatures

How to Mitigate CVE-2026-100865

Immediate Actions Required

Upgrade Heym to version 0.0.53 or later on all deployments
Audit existing workflow definitions and remove or rewrite any condition expressions that use Python reflection or import constructs
Revoke and rotate credentials, API tokens, and secrets accessible to the Heym backend process
Restrict workflow edit and template import permissions to a minimal set of trusted accounts

Patch Information

The fix is distributed in Heym 0.0.53. The upstream commit 341d1012 hardens the workflow executor and tightens webhook signature verification for Slack and Telegram triggers so that missing credentials fail closed. Full details are published in the GitHub Security Advisory GHSA-pm6h-x3h5-j38h.

Workarounds

Disable workflow condition nodes until the patched version is deployed
Block workflow template imports from untrusted or external sources at the application or network layer
Run the Heym backend process under a dedicated low-privilege account with no shell and no write access to sensitive paths
Restrict outbound network access from the backend host to only required destinations

bash

# Verify installed Heym version meets the fixed release
pip show heym | grep -i version

# Upgrade to the patched release
pip install --upgrade 'heym>=0.0.53'