---
id: "CVE-2026-102615"
kind: "vulnerability"
aliases: ["CVE-2026-102615"]
title: "HeyForm: uploaded HTML runs on site origin, reads victim sessions"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["heyform", "nodejs", "package", "self-hosted"]
not_affected_if: ["version-3.0.1-or-later"]
published_at: "2026-11-05T16:17:23+00:00"
first_seen_at: "2026-11-05T16:40:01+00:00"
updated_at: "2026-11-05T16:41:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102615", "first_seen_at": "2026-11-05T16:40:01+00:00"}]
exploit_sources: []
---

# HeyForm: uploaded HTML runs on site origin, reads victim sessions

HeyForm is an open-source form builder whose upload endpoint accepts client-chosen MIME types and serves the file back as text/html with CSP disabled. An attacker can upload HTML that runs with the HeyForm origin when a victim opens the returned link, letting it call the GraphQL API with the victim's session and read or change data that account can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HeyForm version; versions below `3.0.1` are listed as affected.
- Look for `/api/upload` and `static/upload` routes in the deployment.

## Fix

- HeyForm: upgrade to `3.0.1`

## Timeline

- 2026-11-05T16:40:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102615

## Documents

- [advisory] Vendor advisory: github.com https://github.com/heyform/heyform/security/advisories/GHSA-pxw5-pjrc-j758
- [fix] Patch: github.com https://github.com/heyform/heyform/commit/849f7101d4370b29e716b2d7ee14a86c2f598f3a
- [fix] Release notes: github.com https://github.com/heyform/heyform/releases/tag/v3.0.1

## From the sources

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_