Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59721Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

High 7.2

In plain English

A high-severity command injection in hoppscotch from hoppscotch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.0%top 36.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.

Affected products (as reported)

Vendor	Product	Versions
hoppscotch	hoppscotch	< 2026.6.0

Weakness: CWE-77, CWE-78, CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-v7q6-r45w-2c6r x_refsource_CONFIRM
https://github.com/hoppscotch/hoppscotch/pull/6413 x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/commit/73a88c82b1b2cada26cc4b2bc095b54554242239 x_refsource_MISC
https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0 x_refsource_MISC