Vulnerabilities CVE-2026-35198

CVE-2026-35198

Critical

Open

TLP:CLEAR

HeyForm vulnerable to stored XSS via form field titles

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

Details

CVSS Score: 9.0
EPSS Score ⓘ: 0.23%

14.4th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Confidence: 90%
Published: Jul 20, 2026
Last Modified: Jul 20, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.