A flaw in Heym before version 0.0.98 occurs when the server does not apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes. An authenticated user can engineer workflow nodes that include arbitrary URLs and custom headers, and then trigger those nodes. The WebSocket Trigger node returns the response from the requested URL, which can expose internal network resources and sensitive data. This is a classic Server‑Side Request Forgery (CWE‑918) that may lead to internal information disclosure or further compromise if the internal services are vulnerable.

The vulnerability affects all installations of the Heym application running any build prior to version 0.0.98. The affected components are the WebSocket Send and WebSocket Trigger nodes defined in the backend services of the project, notably in websocket_trigger_service.py and websocket_utils.py. Users who can create or modify workflows in those versions are exposed.

The CVSS base score of 5.3 classifies the flaw as moderate severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified. The issue is not listed in CISA KEV, suggesting no widespread, known exploitation yet. The most likely attack vector requires an authenticated user who can embed a WebSocket Trigger node targeting an internal URL; the attacker then receives the returned data directly through the WebSocket interface.