PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59721 hoppscotch CVE debrief

The CVE-2026-59721 record was published on 2026-07-09T18:16:57.200Z. Hoppscotch, an open source API development ecosystem, has a vulnerability in its updateInfraConfigs GraphQL mutation that allows an attacker to execute arbitrary commands as root in the backend container. This issue is fixed in version 2026.6.0. The NVD entry for this CVE is currently Deferred.

Vendor
hoppscotch
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-09
Original CVE updated
2026-07-10
Advisory published
2026-07-09
Advisory updated
2026-07-10

Who should care

Administrators and users of Hoppscotch API development ecosystem should be aware of this vulnerability and take necessary actions to mitigate it. Specifically, those responsible for managing and securing the ecosystem, including operators, platform administrators, vulnerability management teams, and security teams, should review and act on the recommended actions.

Technical summary

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. The vulnerability is fixed in version 2026.6.0, which properly validates and sanitizes MAILER_SMTP_URL values.

Defensive priority

High

Recommended defensive actions

  • Update Hoppscotch to version 2026.6.0 or later
  • Review and restrict access to the updateInfraConfigs GraphQL mutation
  • Validate and sanitize MAILER_SMTP_URL values
  • Monitor for suspicious activity in the backend container
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-09T18:16:57.200Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability is fixed in version 2026.6.0. Evidence from the CVE record and NVD detail indicate that Hoppscotch API development ecosystem is vulnerable to arbitrary command execution as root in the backend container after restart and mail sending due to improper validation of MAILER_SMTP_URL in the updateInfraConfigs GraphQL mutation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59721 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59721

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59721 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59721

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.