CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection
An admin can execute arbitrary commands as root by injecting malicious options into the SMTP URL configuration, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59721?
CVE-2026-59721 is a high-severity command injection vulnerability in hoppscotch, published on 9 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend container after restart and mail sending. This issue is fixed in version 2026.6.0.
Which versions are affected by CVE-2026-59721?
How do I fix CVE-2026-59721?
No fix has been published for CVE-2026-59721 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-59721 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59721 exists.
Sources
Also known as GHSA-v7q6-r45w-2c6r.