CyberRota Analysis
AI-GeneratedHeyForm versions prior to 3.0.0-rc.9 are vulnerable due to inadequate validation of `hiddenFields` submitted by users, allowing attackers to inject arbitrary key/value pairs, including potential XSS payloads and unauthorized metadata. This vulnerability poses a risk of data manipulation and exploitation through webhook integrations that process the stored submissions. Organizations using affected versions should prioritize updating to the patched version to mitigate these security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.hiddenFields`, without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. An anonymous form submitter can therefore inject arbitrary key/value pairs (including XSS payloads, fake authorization metadata, integration-relevant values) into the stored submission. These fields are subsequently forwarded as-is to every webhook integration registered on the form. Version 3.0.0-rc.9 contains a patch for the issue.