PT-2026-56897 · Hoppscotch · Hoppscotch

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-59721

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER SMTP URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

CWE-915

Related Identifiers

CVE-2026-59721

Affected Products

Hoppscotch

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59721 · Security Note
• https://github.com/hoppscotch/hoppscotch/pull/6413 · Note
• https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 · Note
• https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 · Note
• https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r · Note