CVE-2026-35198
HeyForm, an open‑source form builder, had a stored cross‑site scripting flaw that let a low‑privileged team member inject malicious JavaScript. When a team owner viewed the form, the code ran and could hijack the owner’s account. The issue is fixed in version 3.0.0‑rc.7.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
HeyForm form builder, any installation running a version older than 3.0.0‑rc.7.
Real-world impact
An attacker with limited access can embed JavaScript that executes in the browser of a higher‑privileged user, enabling the attacker to take full control of that user’s account.
Why this severity
The CVSS score of 9 reflects that the flaw can be triggered over the network, requires only low effort and low privilege, needs the victim to interact with the form, and changes the scope of the affected system, giving the attacker full control of the account.
What to do about it
- 01Upgrade HeyForm to version 3.0.0‑rc.7 or later.
NVD-referenced vendor advisory
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 22, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.