BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-59721Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.

7.2 HIGHEPSS 1.00%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
7.2HIGH3.1GitHub_M (CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID
CVE-2026-59721
Status
Deferred
Assigner (CNA)
GitHub_M
Published
Jul 9, 2026
Last modified
2026-07-10 19:15 UTC
Weaknesses
  • CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:48 UTC.