heym prior to version 0.0.109 contains an SSRF flaw in its Slack, Discord, and Crawler workflow nodes. The nodes build HTTP requests to URLs taken from user‑created credentials without validating the target address, beyond checking that the URL string is non‑empty. An attacker can supply a webhook or flaresolverr URL that points to a private, loopback, link‑local, or cloud‑metadata location. The backend process then retrieves the full response body and returns it in the node output, giving the attacker non‑blind access to sensitive internal data and services.

Any instance of the heym application running a version earlier than 0.0.109 is vulnerable. The flaw is present in the Slack, Discord, and Crawler nodes and can be exploited by any registered user who can create or modify credentials. The only vendor/product affected is heymrun:heym.

The CVSS base score of 7.6 indicates a high‑severity vulnerability. No EPSS score is available and the issue is not listed in the CISA KEV catalog. Exploitation requires a registered account; the attacker crafts a credential that points to an internal endpoint and triggers a workflow. Because the backend returns the full response body, a single user can probe cloud‑metadata services or other internal systems and exfiltrate information, posing a significant risk to environments exposed via the heym service.