Hoppscotch vulnerabilities
We track 13 vulnerabilities in Hoppscotch products across 3 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on August 18, 2026.
Latest Hoppscotch vulnerabilities
- 7.6 High severity
hoppscotch: Exposure of Sensitive Information to an Unauthorized Actor
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member'
- 7.2 High severity
hoppscotch: Improper Neutralization of Special Elements used in a Command
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment
- 7.5 High severity
hoppscotch: Exposure of Sensitive Information to an Unauthorized Actor
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collection
- 10.0 Critical severity
hoppscotch: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is config
- 7.5 High severity
hoppscotch: Improper Access Control
hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking onboardingCompleted and canReRunOnboarding before allowing config overwrites. H
- 9.3 Critical severity
hoppscotch: Improper Neutralization of Input During Web Page Generation
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This issue has been patched in version 2026.3.0.
- 9.6 Critical severity
hoppscotch: URL Redirection to Untrusted Site
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has bee
- 8.3 High severity
hoppscotch: Authorization Bypass Through User-Controlled Key
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuard
- 9.1 Critical severity
hoppscotch: Improper Access Control
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by
- 7.6 High severity
hoppscotch-extension: Improper Validation of Integrity Check Value
The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a cri
- 8.3 High severity
hoppscotch: Improper Neutralization of Special Elements used in a Command
@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript
- 8.8 High severity
hoppscotch: Insertion of Sensitive Information into Log File
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with ful
- 8.0 High severity
hoppscotch/hoppscotch: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.