{"vulnerability": "CVE-2026-100864", "sightings": [{"uuid": "cf9cf683-2d5f-432e-9c81-8d2b23a31667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100864", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwhr2iucl32d", "content": "\ud83d\udfe0 CVE-2026-100864 - High (8.8)\n\nheym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100864/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-27T02:32:00.537613Z"}, {"uuid": "d41c4cee-4be8-473c-be4d-882012cb2fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100864", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwiszvgvvn2u", "content": "CVE-2026-100864 - heym\nVersions of heym before 0.0.91 let anyone with a valid account craft special expressions that break out of the sandbox and run any Python command on the server. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#heym #heymrun #CVE #infosec", "creation_timestamp": "2026-09-27T12:40:05.677753Z"}]}