CVE-2026-45797: HeyForm Stored XSS Vulnerability

CVE-2026-45797 Overview

CVE-2026-45797 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in HeyForm, an open-source form builder. The /api/upload endpoint accepts unauthenticated file uploads, including SVG files. Uploaded SVGs land in the static assets directory and are served with Content-Type: image/svg+xml by the Express serve-static middleware. An unauthenticated attacker can upload a malicious SVG containing JavaScript and achieve stored XSS on the HeyForm domain. Version 3.0.0-rc.7 contains a patch for this issue.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers within the HeyForm origin, enabling session theft, credential harvesting, and account takeover.

Affected Products

HeyForm versions prior to 3.0.0-rc.7
Self-hosted HeyForm deployments exposing the /api/upload endpoint
Any application embedding HeyForm assets served from the vulnerable static directory

Discovery Timeline

2026-07-20 - CVE-2026-45797 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-45797

Vulnerability Analysis

The vulnerability exists in HeyForm's file upload handler exposed at /api/upload. The endpoint accepts requests without authentication and performs no MIME-type restriction sufficient to block SVG content. Because SVG is an XML dialect that supports embedded <script> elements and event handler attributes, a crafted SVG file executes JavaScript when a browser renders it directly.

HeyForm stores uploaded files in a static assets directory served by Express's serve-static middleware. This middleware infers Content-Type from the file extension. An .svg file is served as image/svg+xml, which browsers interpret as active content rather than as an inert image resource. The result is stored XSS executing under the HeyForm origin.

The attack requires user interaction: a victim must visit the URL of the uploaded SVG or a page that loads it in a rendering context. Once triggered, the script runs with access to cookies, session storage, and any authenticated API surface bound to the HeyForm domain.

Root Cause

The root cause is missing input validation on uploaded file types combined with permissive static file serving. The upload handler does not reject SVG content or strip active elements, and the static file server does not force a safe Content-Type such as text/plain or application/octet-stream with Content-Disposition: attachment.

Attack Vector

An attacker sends an unauthenticated POST request to /api/upload containing an SVG file with an embedded <script> element or event handler. The server stores the file and returns its URL. The attacker distributes the URL through phishing, forum posts, or form submissions. When a victim opens the link, the browser fetches the SVG with Content-Type: image/svg+xml and executes the embedded JavaScript in the HeyForm origin context.

No verified exploit code is publicly indexed. Refer to the GitHub Security Advisory GHSA-m94h-jxvc-hhch and the GitHub Commit Details for technical details on the fix.

Detection Methods for CVE-2026-45797

Indicators of Compromise

Unauthenticated POST requests to /api/upload originating from external IP addresses
SVG files present in HeyForm's static assets directory containing <script>, onload=, onerror=, or javascript: strings
HTTP responses serving .svg resources with Content-Type: image/svg+xml from user-uploaded paths
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting HeyForm URLs

Detection Strategies

Scan the HeyForm uploads directory for .svg files and grep for script tags, event handlers, or xlink:href with javascript: URIs
Enable web server access logging and alert on POST /api/upload requests without authentication headers
Inspect proxy or WAF logs for SVG payloads containing executable content
Monitor Content Security Policy (CSP) violation reports for inline script executions on HeyForm pages

Monitoring Recommendations

Baseline expected upload volume and alert on anomalous spikes to /api/upload
Track user agents and source IPs uploading files to identify automated scanning
Log all served static file responses with image/svg+xml and correlate with recent uploads
Forward web server and application logs to a centralized analytics platform for retention and correlation

How to Mitigate CVE-2026-45797

Immediate Actions Required

Upgrade HeyForm to version 3.0.0-rc.7 or later immediately
Audit the static assets directory and remove any untrusted SVG files
Rotate session tokens and API keys that may have been exposed to a triggered XSS payload
Restrict network access to /api/upload behind authentication or a reverse proxy until patched

Patch Information

The fix is committed in the HeyForm repository at commit 144240e5545d10fd9e120d05ccb402a6d7064674 and released in version 3.0.0-rc.7. Review the GitHub Security Advisory GHSA-m94h-jxvc-hhch for full remediation guidance.

Workarounds

Block SVG uploads at a WAF or reverse proxy by rejecting Content-Type: image/svg+xml and file extensions matching .svg
Configure the static file server to send Content-Disposition: attachment for user-uploaded assets so browsers download rather than render them
Enforce a strict Content Security Policy that disallows inline scripts on the HeyForm origin
Require authentication on /api/upload via an upstream authentication proxy until the patch is applied

bash

# Example nginx rule to force download of user-uploaded SVGs
location /static/uploads/ {
    if ($request_filename ~* \.svg$) {
        add_header Content-Type "text/plain";
        add_header Content-Disposition "attachment";
    }
}