Executive brief
HeyForm is an open-source platform used for building and managing online forms. A security flaw allows anyone on the internet to upload malicious files to the server without needing an account. If a user or administrator views one of these files, an attacker could steal their login session, take over their account, or access sensitive form data.
Technical details
HeyForm prior to version 3.0.0-rc.7 contains a stored cross-site scripting (XSS) vulnerability due to unrestricted file uploads. The `/api/upload` endpoint lacks an `@Auth()` decorator, allowing unauthenticated users to upload SVG files. Because the application's Express `serve-static` middleware serves these files with the `image/svg+xml` MIME type, any embedded JavaScript within the SVG is executed in the context of the victim's browser session when the file is accessed. This allows attackers to perform actions on behalf of users, such as stealing session cookies or executing GraphQL mutations. The issue is fixed in version 3.0.0-rc.7 by blocking SVG uploads and hardening the static file serving configuration.
Affected products
- HeyForm HeyForm < 3.0.0-rc.7
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Fix confirmed in version 3.0.0-rc.7