# CVE-2026-100864: heym expression engine sandbox escape in DotList and fallback resolver

Source: https://junglewise.ai/threats/cve-2026-100864-heym-before-0-0-91-contains-a-sandbox-escape-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100864 · Severity: high · CVSS 8.8 · Published 2026-09-27

heym is a workflow automation platform that lets users define and execute data processing workflows through an expression engine. A vulnerability in the expression engine allows authenticated users to bypass sandbox restrictions and execute arbitrary Python code on the backend server, potentially exposing databases, stored credentials, and internal network access. This could lead to complete system compromise for any organization using heym to run critical workflows.

Technologies: [Heym](https://junglewise.ai/threats/technologies/heym-heym). Vendors: [Heym](https://junglewise.ai/threats/vendors/heym).

## Quick answers

**Is CVE-2026-100864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100864 being exploited in the wild.

**How severe is CVE-2026-100864?** High severity, with a CVSS score of 8.8, published 27 September 2026.

**Which products and versions are affected?** Heym before 0.0.91.

**Is there a fix for CVE-2026-100864?** A patch was published on 2026-09-27: Fixed in version 0.0.91 with dunder filtering, fail-closed fallback, and regression tests Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100864 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100864?** Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in two code paths that bypass simpleeval sandboxing: the DotList item expression evaluator (used by .map()/.filter()/distinctBy()) and the _resolve_simple_expression fallback handler. Both use raw getattr without dunder restrictions, allowing attackers to traverse __class__.__base__.__subclasses__ to access loaded classes and their __init__.__globals__ to reach os.system. The attack requires authentication to edit/execute workflows or access the /api/expressions/evaluate endpoint, and is demonstrated through a chain of three expressions that progressively gains code execution as the backend process.

## Affected products

- heym heym before 0.0.91

## Timeline

- 2026-08-15: disclosed: GitHub Security Advisory GHSA-87x2-9jwx-7gh4 published
- 2026-09-27: advisory: CVE-2026-100864 published on NVD
- 2026-09-27: patched: Fixed in version 0.0.91 with dunder filtering, fail-closed fallback, and regression tests

## References

- [https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4](https://github.com/heymrun/heym/security/advisories/GHSA-87x2-9jwx-7gh4)
- [https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine](https://www.vulncheck.com/advisories/heym-before-0.0.91-remote-code-execution-via-expression-engine)

## Related threats

- [Heym command injection via MCP stdio transport](https://junglewise.ai/threats/cve-2026-67546-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym HTTP node server-side request forgery](https://junglewise.ai/threats/cve-2026-67545-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym workflow engine arbitrary code execution via Playwright node](https://junglewise.ai/threats/cve-2026-67544-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym Python skill execution privilege escalation](https://junglewise.ai/threats/cve-2026-67543-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym server-side request forgery in MCP transports](https://junglewise.ai/threats/cve-2026-67542-heym-builds-and-runs-agentic-systems-and-business-process)