Executive brief
Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the platform's mock server component allows an attacker to inject malicious scripts that execute when a user views certain pages. This could allow an attacker to perform unauthorized actions on behalf of a user, such as stealing access tokens or modifying sensitive API development data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Hoppscotch's backend origin, specifically within mock server responses and cross-team request moves. An attacker can inject a malicious payload into a mock server response body; when a victim navigates to the mock URL, the script executes in the context of the Hoppscotch domain. This execution can be leveraged to perform Cross-Site Request Forgery (CSRF) attacks, such as programmatically creating and exfiltrating Personal Access Tokens (PATs) or querying sensitive user data via the GraphQL API. The vulnerability is rooted in improper neutralization of input during web page generation (CWE-79). It has been addressed in version 2026.3.0 by sanitizing mock server responses and routing operations through the platform backend.
Affected products
- hoppscotch hoppscotch-backend < 2026.3.0
Timeline
- 2026-03-31: patched: Fixed in version 2026.3.0
- 2026-04-02: disclosed: Initial advisory publication