Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-102615HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

High 7.6

In plain English

A high-severity cross-site scripting in heyform from heyform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.

Affected products (as reported)

Vendor	Product	Versions
heyform	heyform	< 3.0.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/heyform/heyform/security/advisories/GHSA-pxw5-pjrc-j758 x_refsource_CONFIRM
https://github.com/heyform/heyform/commit/849f7101d4370b29e716b2d7ee14a86c2f598f3a x_refsource_MISC
https://github.com/heyform/heyform/releases/tag/v3.0.1 x_refsource_MISC