AIKIDO-2026-10462
hoppscotch-backend is vulnerable to Cross-site Scripting (XSS)
55
Medium Risk
This Affects:
hoppscotch-backendTL;DR
Affected versions of this package are vulnerable to stored XSS via path-based mock server responses. An attacker can create a mock example with a script-capable Content-Type and malicious HTML/JavaScript body. When the response is served through the path-based backend URL (<backend-origin>/mock/<id>/...), it is treated as same-origin with the backend, allowing the injected script to perform authenticated actions using the victim’s backend session.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
hoppscotch-backend is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 2026.2.1.
How to fix this
Upgrade the hoppscotch-backend library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.