CVE-2026-59721: fallo de gravedad alta en hoppscotch
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 1.0%
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
hoppscotch · hoppscotchCVEs relacionadas — hoppscotch
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-50160CRITICALMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET OverwriteEPSS 1.7%CVE-2023-34097HIGHDatabase password exposed in logs in hoppscotchEPSS 0.7%CVE-2024-34347HIGH@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCEEPSS 0.6%CVE-2024-27092MEDIUMContent spoofing - real Hoppscotch emailsEPSS 0.6%CVE-2026-59720HIGHHoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock ServerEPSS 0.6%CVE-2026-28215CRITICALhoppscotch Vulnerable to Unauthenticated Onboarding Config TakeoverEPSS 0.6%