Hoppscotch is an open‑source API development ecosystem that includes a GraphQL‑based administration interface. In versions prior to 2026.6.0, the updateInfraConfigs mutation accepts an attacker‑controlled MAILER_SMTP_URL value. The validateSMTPUrl routine allows path, query, or fragment components of that URL to be passed to nodemailer, which interprets them as sendmail transport options. This input flaw permits injection of arbitrary shell commands that execute with root privileges inside the backend container after the application restarts or sends an email. The weakness is a classic command‑injection problem involving CWE‑77 and CWE‑78, coupled with a privilege‑escalation discrepancy (CWE‑915).

All releases of Hoppscotch before 2026.6.0 contain the vulnerability. The exposed component is the GraphQL mutual admin mutation that modifies infrastructure configuration, which is available to users with administrator privileges.

The CVSS score of 7.2 signals high severity. Based on the description, it is inferred that an attacker must authenticate as an administrator or otherwise have the ability to invoke the GraphQL mutation. After submitting a crafted MAILER_SMTP_URL, the injected commands run when the backend container restarts or an email is dispatched, granting full root access within the container. The EPSS score of < 1% indicates a low likelihood of exploitation in the wild, but the risk remains if administrator credentials are compromised or the GraphQL API is exposed to untrusted users. The vulnerability is not listed in CISA KEV, and no publicly known exploits exist.