CyberRota Analysis
AI-GeneratedThe vulnerability in Hoppscotch allows an attacker to exploit the updateInfraConfigs GraphQL mutation by injecting a malicious MAILER_SMTP_URL, which can lead to arbitrary command execution as root in the backend container upon mail sending. This poses a significant risk to systems running versions prior to 2026.6.0, particularly for administrators managing API development environments. Organizations utilizing Hoppscotch should prioritize updating to version 2026.6.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.