CVE-2026-63429

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

CVE-2026-45797

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

CVE-2026-35198

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

CVE-2026-63428

Summary: HeyForm (open-source form builder) prior to 3.0.0-rc.9 stores submitter-supplied hiddenFields unvalidated, allowing an anonymous submitter to inject arbitrary key/value data into submission.hiddenFields. Those fields are forwarded to every webhook integration registered on the form, enab...

CVE-2026-35198 HeyForm vulnerable to stored XSS via form field titles

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

EUVD-2026-45984

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

CVE-2026-35198

HeyForm (open-source form builder) is affected by a stored XSS vulnerability present before version 3.0.0-rc.7. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, enabling complete account takeover through privilege escalation. A fix is av...

EUVD-2026-45983

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

CVE-2026-45797 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

CVE-2026-45797

CVE-2026-45797 affects HeyForm (open-source form builder). Before version 3.0.0-rc.7, the /api/upload endpoint allowed unauthenticated file uploads, including SVGs. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express’s serve-static middle...