Executive brief
Hoppscotch, an open-source API development platform, contains a security flaw in how it displays team member names in shared workspaces. An authenticated user could set a malicious display name that executes code in the browsers of other team members when they hover over or click on the member list. This could allow an attacker to perform unauthorized actions on behalf of other users or interfere with the workspace.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Hoppscotch's MemberStack.vue component. The root cause is the insecure use of tippy.js with the 'allowHTML: true' configuration, which fails to neutralize user-controlled display names before rendering them in the team member overflow tooltip. An authenticated attacker with low privileges can set their display name to an HTML/JavaScript payload. When another user in a shared workspace with four or more members hovers over or clicks the member stack to view the overflow tooltip, the payload executes in their browser context. This allows for session hijacking or DOM manipulation within the scope of the shared workspace. The issue is fixed in version 2026.3.0 by treating display names as plain text.
Affected products
- hoppscotch hoppscotch < 2026.3.0
Timeline
- 2026-03-31: patched: Version 2026.3.0 released
- 2026-03-31: advisory: GitHub Security Advisory GHSA-vw93-4m6p-ccm9 published
- 2026-04-02: disclosed: CVE-2026-34848 published to NVD