PT-2026-56897 · Hoppscotch · Hoppscotch

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-59721

Mitre

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER SMTP URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

CWE-915

Identificadores relacionados

CVE-2026-59721

Produtos afetados

Hoppscotch

Referências · 5

• https://github.com/hoppscotch/hoppscotch/pull/6413 · Nota
• https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 · Nota
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 · Nota
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59721 · Nota de Segurança