CVE-2026-59721
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.t
CVSS
7.2
Alto
EPSS
0.5%
p41
KEV
—
Exploit Today
12
0-100
Publicado: 9 jul 2026 · Última mod.: 10 jul 2026 · CWE-77 · CWE-78 · CWE-915
0.5%EPSS · 30 días0.5%
2026-07-102026-07-17
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.
- github.comhttps://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239
- github.comhttps://github.com/hoppscotch/hoppscotch/pull/6413
- github.comhttps://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0
- github.comhttps://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r
- github.comhttps://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-341978.8 ALT99.9%
KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3dCVE-2024-121210.0 CRÍ99.9%
KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability5dCVE-2026-398089.8 CRÍ99.7%
KEV—80Fortinet FortiSandbox OS Command Injection Vulnerability1dCVE-2022-262589.8 CRÍ99.6%
KEV—80D-Link DIR-820L Remote Code Execution Vulnerability9dCVE-2026-422718.8 ALT99.6%
KEV—80BerriAI LiteLLM Command Injection Vulnerability3dCVE-2021-252988.8 ALT99.5%
KEV—80Nagios XI OS Command Injection9d