CVE-2026-35198

CRITICAL

HeyForm vulnerable to stored XSS via form field titles

Title source: cna
STIX 2.1

Description

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

References (2)

Core 2

Scores

CVSS v3 9.0
EPSS 0.0023
EPSS Percentile 14.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (1)
heyform/heyform < 3.0.0-rc.7
Published Jul 20, 2026
Tracked Since Jul 20, 2026