{"id":"CVE-2026-100864","published":"2026-09-27T02:17:26.260","lastModified":"2026-09-28T20:57:50.143","description":"heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the fallback resolver to access os.system and execute commands as the backend process.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4","tags":[]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4","tags":[]}],"exploitRefs":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4","tags":[]},{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows authenticated users to execute arbitrary Python code through the expression engine's DotList map/filter and fallback resolver, posing a significant risk due to the potential for remote code execution.","exploitability":"Exploitation is relatively straightforward for attackers who can craft workflow expressions to access os.system and execute commands. Precondition is the user must be authenticated and have access to the affected feature.","blast_radius":"If exploited, the impact could be severe, as it allows for arbitrary command execution, potentially leading to full system compromise.","remediation":"Upgrade to version 0.0.91 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","python","expression-engine"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:04:38.076Z"}}