THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-35198 (CRITICAL 9.0) — HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete accoun

[NVD] CVE-2026-35198 (CRITICAL 9.0) — HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete accoun

lownvdPublished 2026-07-20

CVE-2026-35198 CVSS: 9.0 CRITICAL Published: 2026-07-20T16:16:58.440

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-35198cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-35198