CVE-2026-35198: HeyForm Stored XSS Vulnerability

CVE-2026-35198 Overview

CVE-2026-35198 is a stored cross-site scripting (XSS) vulnerability in HeyForm, an open-source form builder. Versions prior to 3.0.0-rc.7 allow a low-privileged team member to inject malicious JavaScript into form builder fields. The payload executes in the browser of a team owner when they view the affected form. Successful exploitation leads to privilege escalation and complete account takeover. The maintainers released version 3.0.0-rc.7 to fix the flaw. The weakness is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A low-privileged collaborator can hijack a team owner's session and gain full administrative control over the HeyForm workspace.

Affected Products

HeyForm versions prior to 3.0.0-rc.7
Self-hosted HeyForm deployments running vulnerable builds
HeyForm workspaces with multi-user team collaboration enabled

Discovery Timeline

2026-07-20 - CVE-2026-35198 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-35198

Vulnerability Analysis

HeyForm's form builder accepts user-supplied content from team members and renders it in the workspace UI without sufficient output encoding. A team member with editing rights can embed JavaScript in fields that are later rendered when higher-privileged users view or edit the form. Because the script runs inside the owner's authenticated session, the attacker inherits the owner's application privileges. This turns a limited collaborator role into a full administrator through client-side code execution.

The EPSS score is 0.234% (percentile 14.346), indicating low observed exploitation probability at publication. However, the attack requires only an authenticated low-privileged user and a single view by an owner. The multi-tenant nature of team form builders makes the trigger condition realistic.

Root Cause

The root cause is improper neutralization of user input during web page generation ([CWE-79]). Form builder attributes stored by one user are rendered into the DOM of other users without contextual escaping or a strict Content Security Policy. The maintainer patch in commit cc97d27 applies sanitization to the affected rendering paths.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with team member privileges. The attacker crafts a form field containing a JavaScript payload and saves it to the shared form. When the team owner opens the form in the builder, the payload executes with the owner's session context. The attacker can then exfiltrate session tokens, invoke privileged API endpoints, add rogue owners, or modify workspace data. Because the scope changes from a low-privileged user to a workspace administrator, the CVSS scope metric is marked as changed.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-chmm-jqpm-3pwx for technical details.

Detection Methods for CVE-2026-35198

Indicators of Compromise

Form builder fields containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in stored form definitions.
Unexpected outbound requests from an owner's browser session to attacker-controlled domains shortly after opening a shared form.
New team owners, API tokens, or webhooks created without a corresponding administrative user action.

Detection Strategies

Inspect the HeyForm database for form field values containing script tags, event handler attributes, or javascript: URIs.
Review web server access logs for unusual /api calls originating from owner sessions immediately after form-view requests.
Correlate team member edit events with subsequent owner-context privileged actions to identify suspicious sequences.

Monitoring Recommendations

Enable and monitor Content Security Policy violation reports from the HeyForm frontend.
Alert on creation of new administrative team members or API keys outside change-management windows.
Track HTTP referer and user-agent anomalies on authenticated administrative endpoints.

How to Mitigate CVE-2026-35198

Immediate Actions Required

Upgrade HeyForm to version 3.0.0-rc.7 or later on all self-hosted instances.
Audit existing forms for stored payloads containing HTML or JavaScript before allowing owners to open them.
Rotate session cookies and API tokens for any owner account that may have viewed attacker-controlled forms.

Patch Information

The fix is included in HeyForm 3.0.0-rc.7. The relevant code change is committed in cc97d27a57ae400fec23abf5dcf6f9533c3b5db3. Full technical details are published in the HeyForm Security Advisory GHSA-chmm-jqpm-3pwx.

Workarounds

Restrict form builder editing to trusted, verified team members until patching is complete.
Deploy a reverse-proxy Content Security Policy that blocks inline scripts and restricts script sources on HeyForm URLs.
Temporarily disable multi-user collaboration on sensitive workspaces if patching cannot be applied immediately.

bash

# Upgrade a self-hosted HeyForm deployment to the patched release
git fetch --tags
git checkout v3.0.0-rc.7
docker compose pull
docker compose up -d