Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-100864heym before 0.0.91 Remote Code Execution via Expression Engine
High 8.8
In plain English
A high-severity code injection in heym from heymrun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-87x2-9jwx-7gh4) vendor-advisory
- VulnCheck Advisory: heym before 0.0.91 Remote Code Execution via Expression Engine third-party-advisory