HeyForm Hidden Fields Injection Vulnerability Allowing Webhook Payload Poisoning

A vulnerability exists in HeyForm, an open-source form builder, in versions prior to 3.0.0-rc.9. The issue arises in the `completeSubmission` mutation, which accepts a `hiddenFields` array from the submitter. This array is stored verbatim in the submission data without validating the `id` or `name` against the form's schema. As a result, an anonymous submitter can inject arbitrary key/value pairs, including XSS payloads, fake authorization data, and other integration-relevant values. These injected fields are then forwarded as-is to every webhook integration associated with the form.

Impact

Exploitation of this vulnerability allows for webhook payload poisoning, where injected hidden field values are sent to external receivers without validation. This could lead to XSS, log injection, SQL injection on naive receivers, or bypassing business logic for receivers that trust hidden field semantics. Additionally, the vulnerability allows overriding of form-creator-controlled hidden fields, potentially disrupting data integrity by altering how information is presented in form-creator dashboards.

Reproduction

To reproduce this vulnerability, send a GraphQL mutation to the `completeSubmission` endpoint. Include an `openToken` that is valid for the target form, and inject custom hidden fields through the `hiddenFields` array. The injected fields can include scripts or other malicious payloads.

Remediation

Users can update to HeyForm version 3.0.0-rc.9 or later, where this vulnerability has been patched.