PT-2026-61622 · Heyform · Heyform

CVE-2026-63428 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HeyForm versions prior to 3.0.0-rc.9

Description The completeSubmission function accepts a hiddenFields array containing id, name, and value from the submitter and stores it in submission.hiddenFields without validating the provided id or name against the declared form.hiddenFields schema. This allows an anonymous submitter to inject arbitrary key/value pairs, such as Cross-Site Scripting (XSS) payloads, fake authorization metadata, or integration-relevant values, into the stored submission. These injected fields are then forwarded without modification to all registered webhook integrations for the form.

Recommendations Update to version 3.0.0-rc.9.

Exploit

Fix

RCE

Weakness Enumeration

CWE-915

CWE-20

Related Identifiers

CVE-2026-63428

GHSA-R7VG-XH87-V4W3

Affected Products

Heyform

References · 6

• 🔥 https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63428.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-63428 · Security Note
• https://osv.dev/vulnerability/CVE-2026-63428 · Vendor Advisory
• https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2 · Note
• https://twitter.com/CVEnew/status/2079238904243204554 · Twitter Post