CVE-2026-35198 - Vulnerability Details - OpenCVE

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3
https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx

History

Mon, 20 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 20 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.
Title		HeyForm vulnerable to stored XSS via form field titles
Weaknesses		CWE-79
References		https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3 https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-20T15:47:21.255Z

Updated: 2026-07-20T19:02:26.984Z

Reserved: 2026-04-01T18:48:58.937Z

Link: CVE-2026-35198

Vulnrichment

Updated: 2026-07-20T19:01:27.849Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35198", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T18:48:58.937Z", "datePublished": "2026-07-20T15:47:21.255Z", "dateUpdated": "2026-07-20T19:02:26.984Z"}, "containers": {"cna": {"title": "HeyForm vulnerable to stored XSS via form field titles", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx"}, {"name": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3", "tags": ["x_refsource_MISC"], "url": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3"}], "affected": [{"vendor": "heyform", "product": "heyform", "versions": [{"version": "< 3.0.0-rc.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T15:47:21.255Z"}, "descriptions": [{"lang": "en", "value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue."}], "source": {"advisory": "GHSA-chmm-jqpm-3pwx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:01:46.436306Z", "id": "CVE-2026-35198", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:02:26.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35198", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-20T19:01:46.436306Z"}}}], "references": [{"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:01:27.849Z"}}], "cna": {"title": "HeyForm vulnerable to stored XSS via form field titles", "source": {"advisory": "GHSA-chmm-jqpm-3pwx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "heyform", "product": "heyform", "versions": [{"status": "affected", "version": "< 3.0.0-rc.7"}]}], "references": [{"url": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx", "name": "https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3", "name": "https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T15:47:21.255Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35198", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:02:26.984Z", "dateReserved": "2026-04-01T18:48:58.937Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T15:47:21.255Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}