What is the CVSS score of EUVD-2026-42653?

EUVD-2026-42653 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Hoppscotch are affected by EUVD-2026-42653?

Hoppscotch self-hosted versions prior to 2026.6.0 contain a command injection flaw allowing authenticated administrators to achieve root-level code execution on backend infrastructure.. A patch is available.

How to fix or mitigate EUVD-2026-42653?

Within 24 hours: Identify all Hoppscotch deployments running versions prior to 2026.6.0 and audit administrator account assignments. Within 7 days: Patch all instances to Hoppscotch 2026.6.0 or later and verify successful deployment. Within 30 days: Review administrative access logs for unauthorized SMTP configuration changes and apply principle-of-least-privilege to minimize active administrator accounts.

Hoppscotch EUVD-2026-42653

| CVE-2026-59721 HIGH

Command Injection (CWE-77)

2026-07-09 security-advisories@github.com

Command Injection

7.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin-only infra mutation makes PR:H; network-reachable GraphQL with a straightforward payload gives AV:N/AC:L, and root command execution yields full C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:38 vuln.today

DescriptionCVE.org

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.

AnalysisAI

Command injection in self-hosted Hoppscotch instances prior to 2026.6.0 allows an authenticated administrator to achieve root-level code execution in the backend container. The updateInfraConfigs GraphQL mutation accepts an attacker-controlled MAILER_SMTP_URL whose path, query, or fragment is parsed by nodemailer into sendmail transport options, turning SMTP configuration into arbitrary command execution once the service restarts and sends mail. No public exploit identified at time of analysis, but the flaw is confirmed and patched upstream in release 2026.6.0.

Technical ContextAI

Hoppscotch is an open-source API development platform (a self-hosted Postman/Insomnia alternative) whose admin backend exposes a GraphQL API for runtime configuration. The vulnerable path lives in admin/infra.resolver.ts, where the updateInfraConfigs mutation persists the MAILER_SMTP_URL value used to configure outbound email. The validateSMTPUrl routine in utils.ts is too permissive: it accepts URL path, query, and fragment components that nodemailer subsequently interprets as sendmail transport options rather than as a benign SMTP endpoint. Because nodemailer's sendmail transport can be pointed at an arbitrary binary with attacker-supplied arguments, this maps to CWE-77 (Command Injection) - untrusted input flows into a command the mail subsystem executes, in this case as root inside the backend container.

RemediationAI

Vendor-released patch: 2026.6.0 - upgrade all self-hosted Hoppscotch backend containers to 2026.6.0 or later, which corrects validateSMTPUrl to reject path/query/fragment content that nodemailer would treat as sendmail options (fix commit 73a88c82b1b2cada26cc4b2bc095b54554242239, PR https://github.com/hoppscotch/hoppscotch/pull/6413, advisory https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r). If immediate patching is not possible, restrict and audit who holds admin/infra-configuration rights since the mutation requires admin privileges, keep the admin GraphQL endpoint off untrusted networks, and treat the MAILER_SMTP_URL value as security-sensitive by validating that it is a plain host:port SMTP URL with no path, query string, or fragment before it is applied; these controls only reduce exposure and do not close the underlying injection, so upgrading remains the only complete fix. Because the payload fires on restart and mail send, also review the current MAILER_SMTP_URL setting for any injected sendmail options before the next restart.