Sandbox Escape Vulnerability in heym by heymrun

CVE-2026-100864

What is CVE-2026-100864?

The heym product by heymrun prior to version 0.0.91 is vulnerable to a sandbox escape, specifically within the expression engine's DotList map/filter and fallback resolver. This vulnerability enables authenticated users to leverage crafted workflow expressions, which manipulate dunder attribute access to interact with the backend. As a result, attackers can execute arbitrary Python code and potentially access sensitive system capabilities, such as running commands through os.system, posing significant security risks.

References