CVE-2026-59721: Hoppscotch OS command injection in admin SMTP configuration

CVE-2026-59721 · Severity: high · CVSS 7.2 · Published 2026-07-09

Hoppscotch is an open-source platform used by developers to build and test APIs. A security flaw in the administrative settings allows an authorized administrator to inject malicious commands into the system's mail configuration. If exploited, an attacker can take full control of the backend server, potentially leading to the theft of sensitive database credentials, encryption keys, and user data.

Technologies: Hoppscotch (Self-Hosted). Vendors: Hoppscotch.

Quick answers

Is CVE-2026-59721 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59721 being exploited in the wild.
How severe is CVE-2026-59721?
High severity, with a CVSS score of 7.2, published 9 July 2026.
Which products and versions are affected?
Hoppscotch (Self-Hosted) <= 2026.5.0.
Is there a fix for CVE-2026-59721?
A patch was published on 2026-06-11: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59721 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59721?
Check whether you run Hoppscotch (Self-Hosted) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the Hoppscotch backend due to improper validation of the MAILER_SMTP_URL configuration. The 'updateInfraConfigs' GraphQL mutation allows an administrator to provide a crafted SMTP URL containing query parameters (e.g., 'sendmail=true&path=/bin/sh'). Because the 'validateSMTPUrl' utility failed to reject path or query fragments, these parameters are passed to the underlying 'nodemailer' library. Nodemailer parses these into 'sendmail' transport options, allowing the attacker to specify an arbitrary binary and arguments to be executed via 'child_process.spawn' when the system attempts to send an email (such as a magic-link sign-in). In the official Docker AIO image, this results in Remote Code Execution (RCE) as the root user. The issue is fixed in version 2026.6.0 by implementing stricter URL validation using the WHATWG URL API.

Affected products

  • Hoppscotch Hoppscotch (Self-Hosted) <= 2026.5.0

Timeline

  • 2026-06-11: patched: Fix merged into main branch
  • 2026-06-30: advisory: Release 2026.6.0 published
  • 2026-07-09: disclosed: CVE-2026-59721 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.