HeyForm’s completeSubmission API currently accepts a hiddenFields array supplied by the submitter and stores it directly in the submission record without validating the identifiers against the form’s declared hidden‑field schema. This flaw, identified as CWE‑20 (Improper Input Validation) and CWE‑915 (Potential Loss of Data Integrity), allows an attacker to inject arbitrary key/value pairs, which may include XSS payloads or bogus authorization information. The injected fields are subsequently exported unchanged to every webhook integration configured for the form, giving the attacker a channel to exfiltrate data or tamper with downstream services.

HeyForm, the open‑source form builder, is affected in all releases prior to version 3.0.0‑rc.9. Any deployment of HeyForm that has not upgraded to or beyond the patched version is vulnerable, regardless of the environment. The vulnerability is present in the completeSubmission endpoint and does not require any additional configuration to be exploitable.

With a CVSS score of 5.8 the vulnerability is considered moderate; however, its EPSS score of < 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an HTTP POST to the form’s submission endpoint, which is accessible to anonymous users; once crafted hiddenFields are submitted, they are persisted and forwarded to any configured webhook, effectively allowing an attacker to exfiltrate or manipulate integration data.