CVE-2026-63428: HeyForm XSS Vulnerability

CVE-2026-63428 Overview

CVE-2026-63428 is an input validation vulnerability [CWE-20] in HeyForm, an open-source form builder. Prior to version 3.0.0-rc.9, the completeSubmission endpoint accepts a hiddenFields array from anonymous submitters and stores it verbatim in submission.hiddenFields. The application never validates the supplied id and name against the form's declared form.hiddenFields schema. An attacker can inject arbitrary key/value pairs, including cross-site scripting (XSS) payloads and fabricated authorization metadata. These attacker-controlled fields are then forwarded as-is to every webhook integration registered on the form, extending the attack surface to downstream systems.

Critical Impact
Anonymous form submitters can inject arbitrary hidden field data that persists in submissions and propagates to all connected webhook integrations.

Affected Products

HeyForm versions prior to 3.0.0-rc.9
HeyForm self-hosted deployments accepting anonymous form submissions
Downstream webhook integrations consuming HeyForm submission payloads

Discovery Timeline

2026-07-20 - CVE-2026-63428 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63428

Vulnerability Analysis

The flaw resides in the completeSubmission handler, which trusts submitter-supplied metadata. The endpoint accepts a hiddenFields: [{id, name, value}] array and persists each entry directly to the submission document. Because no schema comparison is performed against form.hiddenFields, a submitter can declare hidden fields that were never defined by the form owner.

The impact extends beyond stored data. Every registered webhook receives the full submission payload, meaning injected values flow into external systems such as customer relationship management (CRM) tools, notification services, or automation platforms. Downstream consumers that treat the data as trusted may render unescaped values, evaluate injected authorization flags, or route records based on attacker-controlled identifiers.

Root Cause

The root cause is missing server-side validation on user-supplied input [CWE-20]. The submission handler does not enforce that each id and name in the incoming hiddenFields array corresponds to a field declared in the form's schema. This allows arbitrary keys and values to be accepted and stored.

Attack Vector

An unauthenticated attacker crafts a form submission that includes a hiddenFields array with attacker-defined identifiers and values. The values may contain XSS payloads targeting administrators who view the submission, forged metadata intended to bypass downstream authorization logic, or crafted strings that alter webhook processing behavior. Because the attack requires only a network request to a public form endpoint, no privileges or user interaction beyond form submission are needed.

The upstream patch hardens URL protocol handling in the form renderer as part of the same security surface remediation:

typescript

// Source: https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2
// packages/answer-utils/src/html-utils.ts

-const UNSAFE_URL_PROTOCOL_REGEX = /^\s*(?:javascript|vbscript|data):/i
+const UNSAFE_URL_PROTOCOLS = new Set(['javascript', 'vbscript', 'data'])
+const URL_PROTOCOL_CONTROL_CHARS_REGEX = /[\\u0000-\\u001f\\u007f\s]+/g
+
+export function isUnsafeUrlProtocol(value: unknown): boolean {
+  const matched = String(value || '')
+    .trimStart()
+    .match(/^([^:]+):/)
+
+  if (!matched) {
+    return false
+  }
+
+  const protocol = matched[1].replace(URL_PROTOCOL_CONTROL_CHARS_REGEX, '').toLowerCase()
+  return UNSAFE_URL_PROTOCOLS.has(protocol)
+}

 function escapeText(value: unknown): string {
   return String(value).replace(/</g, '<').replace(/>/g, '>')

This patch replaces a regex-only protocol check with a normalization routine that strips control characters and whitespace before comparing against a set of unsafe protocols such as javascript:, vbscript:, and data:.

Detection Methods for CVE-2026-63428

Indicators of Compromise

Submission records in HeyForm containing hiddenFields entries whose id or name does not match any field defined in the parent form's schema.
Webhook delivery logs showing payloads with unexpected hidden field keys or values containing HTML/JavaScript syntax.
Anomalous form submissions from anonymous sources containing hidden field values that resemble XSS payloads or authorization tokens.

Detection Strategies

Audit stored submissions and compare each hidden field entry against the form's declared form.hiddenFields schema, flagging unrecognized keys.
Inspect outbound webhook payloads for hidden field values containing script tags, event handlers, or unsafe URL protocols such as javascript:, vbscript:, or data:.
Monitor downstream integration systems for records that originated from HeyForm submissions with unexpected metadata fields.

Monitoring Recommendations

Enable request logging on the completeSubmission endpoint and retain submission bodies for retrospective analysis.
Alert on repeated submissions from a single source that include hidden field arrays with varying or oversized payloads.
Track webhook consumer error rates, as malformed injected values often cause parsing exceptions downstream.

How to Mitigate CVE-2026-63428

Immediate Actions Required

Upgrade HeyForm to version 3.0.0-rc.9 or later, which contains the schema-enforcement fix.
Review historical submissions and webhook logs for injected hidden fields and purge or sanitize affected records.
Rotate any credentials or tokens whose values may have been referenced or leaked via webhook forwarding.

Patch Information

The fix is delivered in HeyForm 3.0.0-rc.9. See the GitHub Security Advisory GHSA-r7vg-xh87-v4w3 and the GitHub commit hardening form security surfaces for implementation details. The patch also strengthens URL protocol validation in the form renderer as part of a broader security-surface hardening effort.

Workarounds

If immediate patching is not possible, disable webhook integrations on forms that accept anonymous submissions until the upgrade is applied.
Add a reverse proxy or API gateway rule that strips the hiddenFields array from incoming completeSubmission requests when unnecessary.
Treat all submission data as untrusted in downstream consumers by escaping output and validating expected field names before use.

bash

# Upgrade HeyForm to the patched release
npm install heyform@3.0.0-rc.9

# Or, for Docker-based deployments, pull the patched image tag
docker pull heyform/heyform:3.0.0-rc.9
docker compose up -d