HeyForm runs uploaded HTML files as active pages, exposing account data
Personal data of people logged into HeyForm can be stolen.
Summary
Uploaded HTML files in the HeyForm form builder run on the HeyForm site, so when a victim opens the link, the file can read or change data in that victim's account. Versions before 3.0.1 are affected.
Affected when
- HeyForm versions before 3.0.1
- the victim opens the link to the uploaded file
What to do
Update to HeyForm 3.0.1 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen