{"id":"CVE-2026-102615","kind":"vulnerability","aliases":["CVE-2026-102615"],"related":[],"title":"HeyForm: uploaded HTML runs on site origin, reads victim sessions","description":"HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.","summary":"HeyForm is an open-source form builder whose upload endpoint accepts client-chosen MIME types and serves the file back as text/html with CSP disabled. An attacker can upload HTML that runs with the HeyForm origin when a victim opens the returned link, letting it call the GraphQL API with the victim's session and read or change data that account can access.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["heyform","nodejs","package","self-hosted"],"not_affected_if":["version-3.0.1-or-later"],"how_to_check":"- Check the installed HeyForm version; versions below `3.0.1` are listed as affected.\n- Look for `/api/upload` and `static/upload` routes in the deployment.","fix":"- HeyForm: upgrade to `3.0.1`","status":"open","published_at":"2026-11-05T16:17:23+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:31+00:00","updated_at":"2026-11-05T16:41:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:30Z","model":"claude-haiku-5-5","output":{"fix":"- HeyForm: upgrade to `3.0.1`","reach":"internet","title":"HeyForm: uploaded HTML runs on site origin, reads victim sessions","impact":"high","summary":"HeyForm is an open-source form builder whose upload endpoint accepts client-chosen MIME types and serves the file back as text/html with CSP disabled. An attacker can upload HTML that runs with the HeyForm origin when a victim opens the returned link, letting it call the GraphQL API with the victim's session and read or change data that account can access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["heyform","self-hosted","nodejs"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script reads or modifies victim's data via GraphQL","analyst_note":"Confirm whether the public form upload path (formId/openToken/fieldId) is reachable unauthenticated; the advisory did not verify it, see the Patch and Vendor advisory links on github.com.","how_to_check":"- Check the installed HeyForm version; versions below `3.0.1` are listed as affected.\n- Look for `/api/upload` and `static/upload` routes in the deployment.\n- unknown whether unauthenticated upload via public forms is exploitable; the advisory did not verify it end to end.","plain_action":"","needs_analyst":true,"not_affected_if":["version-3.0.1-or-later"],"who_is_affected":"Self-hosted or deployed HeyForm instances before 3.0.1 that accept uploads. Any ordinary user account can upload the malicious file, and the impact is on the HeyForm origin, so users who open the link are exposed. The advisory says the public form path was not fully verified, so unknown whether anonymous users can trigger it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4384,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102615':13A,16A '-2026':12A,15A '/api/upload':99C '/graphql':155C '3.0.1':98C,214C 'accept':34B,100C 'access':87B,154C 'accord':103C 'account':85B,169C 'activ':133C,179C 'advisori':197C 'also':172C 'although':195C 'api':73B 'attack':51B 'avail':166C 'back':44B 'belong':188C 'builder':30B,95C 'call':70B 'chang':82B 'chosen':37B 'client':36B,107C 'client-chosen':35B 'client-control':106C 'code':171C 'contentsecuritypolici':125C 'control':108C 'csp':48B 'cve':11A,14A 'data':83B,165C 'disabl':49B 'end':205C,207C 'endpoint':33B 'execut':136C 'fals':126C 'fieldid':187C 'file':43B,102C,121C,191C 'file.mimetype':110C 'filenam':115C 'fix':211C 'form':29B,94C,181C 'formid':183C 'fulli':200C 'graphql':72B 'heyform':1A,17B,23B,59B,88C,139C 'host':22B 'html':3A,54B,114C,134C 'issu':209C 'let':68B 'link':67B 'mime':38B 'modifi':164C 'multipart':109C 'nodej':18B 'open':27B,64B,92C,144C 'open-sourc':26B,91C 'opentoken':184C 'ordinari':128C 'origin':7A,60B,140C,151C 'packag':19B 'path':204C 'permit':173C 'prior':96C 'public':180C 'question':194C 'read':8A,80B,162C 'request':175C 'result':120C 'retain':112C 'return':66B,146C 'run':4A,56B 'same-origin':149C 'script':152C 'self':21B 'self-host':20B 'serv':41B,118C 'session':10A,78B,160C 'signatur':193C 'site':6A 'sourc':28B,93C 'static/upload':117C 'text/html':46B,123C 'therefor':131C 'tie':176C 'type':39B 'unauthent':203C 'upload':2A,32B,53B,132C,174C 'url':147C 'user':129C 'verifi':201C 'version':213C 'victim':9A,63B,76B,143C,158C 'whose':31B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or deployed HeyForm instances before 3.0.1 that accept uploads. Any ordinary user account can upload the malicious file, and the impact is on the HeyForm origin, so users who open the link are exposed. The advisory says the public form path was not fully verified, so unknown whether anonymous users can trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["heyform","high","nodejs","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-06T07:49:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102615","severity":null,"published_at":"2026-11-05T16:17:23+00:00","modified_at":"2026-11-05T16:17:24+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":77607,"url":"https://github.com/heyform/heyform/commit/849f7101d4370b29e716b2d7ee14a86c2f598f3a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":77608,"url":"https://github.com/heyform/heyform/releases/tag/v3.0.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77609,"url":"https://github.com/heyform/heyform/security/advisories/GHSA-pxw5-pjrc-j758","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-06T07:49:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}