Executive brief
HeyForm is an open-source platform used to build and manage online forms. A security flaw allows a team member with low-level access to inject malicious code into a form's title or description. When a team owner views that form, the code automatically runs in their browser, allowing the attacker to take full control of the account, access sensitive form data, and lock out legitimate users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in HeyForm's form builder component due to improper sanitization of user-controlled input. Specifically, the 'updateFormSchemas' GraphQL mutation allows users to submit arbitrary HTML/JavaScript in form field titles and descriptions, which are subsequently rendered using 'innerHTML' in 'Block.tsx'. An attacker with low-privileged team access can inject a payload that, when viewed by a team owner, executes in the owner's context. This can be leveraged to perform administrative actions, such as calling the 'transferTeam' mutation to escalate privileges and achieve full account takeover. The issue is resolved in version 3.0.0-rc.7 by implementing input sanitization and safe rendering practices.
Affected products
- heyform HeyForm < 3.0.0-rc.7
Timeline
- 2026-05-15: patched: Fix committed to repository
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD