What is the CVSS score of EUVD-2026-18536?

EUVD-2026-18536 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-18536?

Yes, a patch is available for EUVD-2026-18536. Update the affected software to the latest version immediately.

Hoppscotch EUVD-2026-18536

| CVE-2026-34848 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-02 GitHub_M

XSS Hoppscotch

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.0

EUVD ID Assigned

Apr 02, 2026 - 20:16 euvd

EUVD-2026-18536

Analysis Generated

Apr 02, 2026 - 20:16 vuln.today

CVE Published

Apr 02, 2026 - 19:20 nvd

MEDIUM 5.4

DescriptionCVE.org

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability in the team member overflow tooltip via display name. This issue has been patched in version 2026.3.0.

AnalysisAI

Stored cross-site scripting (XSS) in Hoppscotch prior to version 2026.3.0 allows authenticated users to inject malicious scripts via the team member display name field, which executes when other users view the overflow tooltip. The vulnerability requires user interaction (viewing the tooltip) and affects the confidentiality and integrity of affected sessions with a CVSS score of 5.4. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

This is a classic stored XSS vulnerability (CWE-79) in a web-based API development platform. Hoppscotch likely stores user display names in a database without proper input sanitization or output encoding. When the team member display name exceeds a certain length and triggers an overflow tooltip in the UI, the application renders the unsanitized display name directly into the DOM, allowing an attacker to inject arbitrary HTML/JavaScript payloads. The vulnerability is specific to the team collaboration feature where multiple users manage shared workspaces. The affected product is identified by CPE cpe:2.3:a:hoppscotch:hoppscotch:*:*:*:*:*:*:*:*, covering all instances of Hoppscotch application before the patched release.

RemediationAI

Vendor-released patch: upgrade to Hoppscotch version 2026.3.0 or later. The patched release is available at https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0. No workarounds for earlier versions are documented. Organizations using self-hosted or on-premise Hoppscotch deployments should prioritize updating to the patched version. The fix addresses the underlying sanitization issue in the team member display name field to prevent stored XSS injection.