Executive brief
VaahCMS, a content management system, was found to contain malicious code within its email notification system. This code is automatically triggered when a user opens a security-related email (such as a one-time password) in a browser with JavaScript enabled. An attacker could use this to steal passwords, monitor private WhatsApp Web conversations, or take control of the user's browser session, leading to significant data theft and account compromise.
Technical details
A supply chain compromise resulted in the insertion of malicious obfuscated JavaScript (CWE-506) into the 'security-otp.blade.php' template of VaahCMS. When an OTP email is rendered in a browser, the payload executes without user interaction beyond opening the email. The script establishes a WebSocket connection to a command-and-control (C2) server, deploys a keylogger targeting password fields via MutationObserver, and scrapes WhatsApp Web content from the DOM. It also supports remote commands for page redirection and content overwriting. The issue was addressed in version 2.3.5 by removing the malicious script.
Affected products
- webreinvent VaahCMS 2.0.0 - 2.3.4
Timeline
- 2026-03-30: patched: Hotfix merged in GitHub repository to remove malicious script and bump version to 2.3.5
- 2026-07-29: disclosed: Vulnerability details published by VulnCheck and NVD