Executive brief
Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the administrative settings allows an authorized administrator to inject malicious commands into the system's mail configuration. If exploited, an attacker can take full control of the backend server, potentially leading to the theft of sensitive database credentials, encryption keys, and user data.
Technical details
An OS command injection vulnerability exists in the Hoppscotch backend due to improper validation of the MAILER_SMTP_URL configuration. The 'updateInfraConfigs' GraphQL mutation allows an administrator to provide a crafted SMTP URL containing query parameters (e.g., 'sendmail=true&path=/bin/sh'). Because the 'validateSMTPUrl' utility failed to reject path or query fragments, these parameters are passed to the underlying 'nodemailer' library. Nodemailer parses these into 'sendmail' transport options, allowing the attacker to specify an arbitrary binary and arguments to be executed via 'child_process.spawn' when the system attempts to send an email (such as a magic-link sign-in). In the official Docker AIO image, this results in Remote Code Execution (RCE) as the root user. The issue is fixed in version 2026.6.0 by implementing stricter URL validation using the WHATWG URL API.
Affected products
- Hoppscotch Hoppscotch (Self-Hosted) <= 2026.5.0
Timeline
- 2026-06-11: patched: Fix merged into main branch
- 2026-06-30: advisory: Release 2026.6.0 published
- 2026-07-09: disclosed: CVE-2026-59721 published to NVD