CVE-2026-35198 | HeyForm is an open-source form builder. Prior to version 3.0… | CVSS 9.0 CRITICAL

Description

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

Metadata

CVE ID: CVE-2026-35198
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-01 18:48 UTC
Published: 2026-07-20 15:47 UTC
Last updated: 2026-07-20 19:02 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: heyform / heyform
Sources: cve.org · NVD

Severity & Metrics

9.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
heyform	heyform	—	< 3.0.0-rc.7

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References (2)

https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx
https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3 https://github.com/heyform/heyform/commit/cc97d27a57ae400fec23abf5dcf6f9533c3b5db3