Medium severity · published Sep 1, 2026
CVE-2026-84207
Heym before 0.0.98 SSRF via WebSocket endpoints
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
heym · heymrun
before 0.0.98 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-84207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-84207
github.com
https://github.com/heymrun/heym
github.com
https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py
github.com
https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py
github.com
https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c
github.com
https://github.com/heymrun/heym/releases/tag/v0.0.98
github.com
https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596
More from heym
8.8
CVE-2026-55376
heym Python Tool Sandbox Escape
8.8
CVE-2026-100865
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
8.8
CVE-2026-100864
heym before 0.0.91 Remote Code Execution via Expression Engine
8.8
CVE-2026-45227
Heym < 0.0.21 Sandbox Escape via Python Introspection
7.6
CVE-2026-45225
Heym < 0.0.21 Path Traversal File Upload via upload_file()