rootpwn

critical · CVSS v3 8.8 · CVSS v4 8.7 · EPSS 0.00686

CVE-2026-100864

CVE-2026-100864 is a critical sandbox escape in the heym expression engine that allows authenticated users to execute arbitrary Python code.

Overview

CVE-2026-100864 is a critical sandbox escape in the heym expression engine that allows authenticated users to execute arbitrary Python code. The vulnerability resides in the DotList map/filter and fallback resolver, enabling attackers to invoke os.system via crafted workflow expressions. It can lead to full system compromise on the backend.

Description

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.

Impact

Confidentiality, integrity, and availability are all at risk because attackers can run arbitrary code on the backend, potentially exfiltrating data, modifying system state, or causing denial of service. The primary impact is on the backend service and any data it processes, affecting administrators and users who rely on the platform.

Remediation

Apply the official patch that updates heym to version 0.0.92 or later, which removes the vulnerable DotList map/filter and fallback resolver logic. If a patch is not immediately available, restrict authenticated access to the expression engine, disable the fallback resolver, or sandbox the execution environment to prevent os.system calls.

Risk context

The vulnerability is rated critical with a CVSS v3 score of 8.8 and an EPSS of 0.00686, indicating a low probability but high impact scenario. Defenders should prioritize patching or mitigation promptly to prevent potential exploitation.

Affected products

  • heym 0.0.91

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
8.7
EPSS
0.00686

sandbox escape Python code execution critical heym expression engine authenticated

← All CVEs

Related CVEs

critical

CVE-2026-100740

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

View analysis

critical

CVE-2026-100721

The critical CVE-2026-100721 affects the vm2 sandbox library, allowing an authorization bypass in the NodeVM external-module resolver. By configuring a custom resolver with context set to 'host', an attacker can load non-allowlisted modules that share a path prefix, causing host code execution. This flaw enables arbitrary code execution in the host process.

View analysis

critical

CVE-2026-100835

Contrast Security's Contrast platform before version 1.16.0 allows remote attestation relay attacks, enabling attackers to impersonate a trusted Coordinator or workload by relaying forged TEE attestation reports. This flaw bypasses the intended binding of attestation to specific hardware, undermining the integrity of Contrast's attested TLS (aTLS). The vulnerability can be exploited by intercepting traffic between the CLI and Coordinator or between the Coordinator and an attested component.

View analysis

critical

CVE-2026-100852

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.

View analysis