CVE-2026-100864 in heym
Summary
by MITRE • 09/27/2026
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The identified security flaw resides within the expression engine of HeyM prior version 0.0.91, specifically affecting the handling of DotList map operations, filter functions, and the associated fallback resolution mechanism. This vulnerability constitutes a critical sandbox escape that permits authenticated users to bypass intended execution boundaries and achieve arbitrary code execution on the backend server. The root cause lies in how the engine processes item expressions and resolves attribute access through dunder methods, which are special Python attributes denoted by double underscores such as _class_ or _subclasses_. By leveraging these internal object attributes, an attacker can traverse the class hierarchy to locate sensitive modules like os that were not explicitly exposed but remain accessible within the Python runtime environment.
From a technical perspective, the vulnerability exploits the flexibility of Python's dynamic attribute resolution. When the expression engine evaluates a DotList operation or utilizes its fallback resolver, it does not sufficiently restrict access to dunder attributes on list items or resolved objects. An attacker can craft a malicious workflow expression that accesses _class_ to retrieve the base class object, then uses _subclasses_() to iterate through available subclasses until finding one with access to built-in modules. Once this path is established, the attacker invokes os.system() via these indirect references, effectively breaking out of the restricted sandbox environment. This technique allows for the execution of arbitrary operating system commands under the privileges of the backend process running HeyM, which often possesses elevated permissions necessary for application functionality.
The operational impact of this vulnerability is severe, as it leads to full remote code execution on the affected server infrastructure. Since authentication is required, the attack surface is limited to valid users; however, even low-privileged accounts can leverage this flaw to escalate their access significantly. Successful exploitation allows an adversary to read sensitive configuration files, exfiltrate database contents, install backdoors, or pivot further into the internal network depending on the deployment context and permissions of the backend service. This represents a complete compromise of confidentiality, integrity, and availability for systems running vulnerable versions of HeyM.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves crafting input that is interpreted as executable code by the application's engine. Furthermore, in terms of adversary tactics, this technique corresponds to ATT&CK T1059 Command and Scripting Interpreter, specifically leveraging Python for execution, and potentially relates to privilege escalation techniques if the backend process runs with high privileges. The exploitation method also reflects aspects of CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection), although it occurs through a programmatic expression engine rather than direct shell injection.
To mitigate this risk, organizations must immediately upgrade HeyM to version 0.0.91 or later where the sandbox restrictions have been tightened and dunder attribute access is properly sanitized within the DotList map/filter and fallback resolver logic. Until an update can be applied, administrators should consider restricting network access to the HeyM backend interface to trusted IP ranges only and ensuring that the backend process runs with minimal necessary privileges using principles of least privilege. Additionally, implementing strict input validation on workflow expressions at a proxy or gateway level may help block known exploitation patterns involving dunder attribute traversal before they reach the vulnerable engine logic.