PatchSiren cyber security CVE debrief
CVE-2026-63428 heyform CVE debrief
CVE-2026-63428 is a vulnerability in HeyForm, an open-source form builder. The `completeSubmission` function accepts a `hiddenFields` array from the submitter and stores it without validating the supplied `id`/`name` against the form's declared `form.hiddenFields` schema. This allows an anonymous form submitter to inject arbitrary key/value pairs, including potential XSS payloads, fake authorization metadata, and integration-relevant values, into the stored submission. These fields are then forwarded to every webhook integration registered on the form. The issue was patched in version 3.0.0-rc.9.
- Vendor
- heyform
- Product
- Unknown
- CVSS
- MEDIUM 5.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-20
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-20
Who should care
Users of HeyForm, especially those who use webhook integrations, should be aware of this vulnerability and take steps to protect themselves. This includes updating to version 3.0.0-rc.9 or later and reviewing their form configurations for potential vulnerabilities.
Technical summary
The `completeSubmission` function in HeyForm accepts a `hiddenFields` array from the submitter and stores it verbatim in `submission.hiddenFields` without validation. This allows an attacker to inject arbitrary key/value pairs into the stored submission, which can then be forwarded to webhook integrations. The issue is patched in version 3.0.0-rc.9, which adds validation for the supplied `id`/`name` against the form's declared `form.hiddenFields` schema.
Defensive priority
Medium
Recommended defensive actions
- Update to version 3.0.0-rc.9 or later
- Review form configurations for potential vulnerabilities
- Monitor form submissions for suspicious activity
- Implement additional security measures, such as input validation and sanitization
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Evidence notes
The CVE record was published on 2026-07-20T16:17:06.680Z and last modified on 2026-07-20T17:18:21.297Z. The NVD entry is currently Unverified. The vulnerability has a CVSS score of 5.8 and a severity of MEDIUM.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T16:17:06.680Z and has not been modified since then. The NVD entry is currently Unverified.