CVE-2026-34932

CRITICAL

hoppscotch: Stored XSS via mock server responses on backend origin

Title source: cna

Description

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This issue has been patched in version 2026.3.0.

References (2)

Scores

CVSS v3 9.3
EPSS 0.0001
EPSS Percentile 2.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (1)
hoppscotch/hoppscotch < 2026.3.0 (2 CPE variants)
Published Apr 02, 2026
Tracked Since Apr 03, 2026