Hoppscotch vulnerabilities

In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.

CVE-2026-44478 vulnerability in hoppscotch allows unauthenticated users to access infrastructure secrets in plaintext via the GET /v1/onboarding/config endpoint when the ONBOARDING_RECOVERY_TOKEN is an empty string. This issue is fixed in version 2026.4.0.

In self-hosted Hoppscotch deployments version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The missing whitelist: true in NestJS ValidationPipe allows extra request properties like JWT_SECRET and SESSION_SECRET to be treated as valid InfraConfig entries, enabling an attacker to overwrite them.

Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.

Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.

A vulnerability in Hoppscotch before version 2026.6.0 allows an admin to execute arbitrary commands as root in the backend container. The attack involves manipulating the MAILER_SMTP_URL parameter in the updateInfraConfigs GraphQL mutation, which is then parsed by nodemailer into sendmail transport options.

In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.

Hoppscotch, an open source API development ecosystem, contains a stored XSS vulnerability in the team member overflow tooltip via display name. This issue exists prior to version 2026.3.0.

In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.

In versions prior to 2023.4.5, hoppscotch exposes the database password in logs when showing the database connection string. Attackers with access to system logs can gain full access to the database.