CVE-2026-59721: Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hoppscotchto a version that resolves this vulnerability.Fixed in 2026.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59721?
The severity of CVE-2026-59721 is classified as high with a score of 7.2.
How do I fix CVE-2026-59721?
To address CVE-2026-59721, update to version 2026.6.0 or later of Hoppscotch where the vulnerability is patched.
What are the potential impacts of CVE-2026-59721?
CVE-2026-59721 can lead to remote code execution through administrator access when the MAILER_SMTP_URL is manipulated.
Which software is affected by CVE-2026-59721?
CVE-2026-59721 affects the Hoppscotch API development ecosystem prior to version 2026.6.0.
What type of vulnerability is CVE-2026-59721?
CVE-2026-59721 is categorized as a command injection vulnerability, specifically an OS command injection risk.