HeyForm accepted files according to a client‑supplied MIME type and preserved the original filename. When a file containing active HTML was uploaded, the static /upload endpoint served it as text/html without setting a Content‑Security‑Policy header, giving an attacker an opportunity to inject stored XSS. An HTML file reachable at its URL can execute within the HeyForm origin, giving the attacker a same‑origin script that can call the /graphql endpoint with the victim’s session cookie and read or modify information stored in the victim’s account.

All instances of HeyForm running a version prior to 3.0.1 are affected. The vulnerable functionality involves the /api/upload endpoint and the static /upload service of the heyform:heyform product.

The vulnerability receives a CVSS score of 7.6, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by uploading any HTML file and having an unsuspecting user open the returned URL, thus triggering script execution confined to the HeyForm origin. The confirmed fix is implemented in version 3.0.1; until an update is applied, the flaw can be abused by anyone with upload capability in a given HeyForm deployment.