CVE-2026-67595

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67595
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67595.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67595
Published
2026-07-29T21:33:25.952Z
Modified
2026-07-30T04:03:31.715771387Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php
Details

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

Database specific 
{
    "cwe_ids": [
        "CWE-506"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67595.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/webreinvent/vaahcms

Affected ranges

Type
GIT
Repo
https://github.com/webreinvent/vaahcms
Events
Introduced
a706f96a85bb16bdb412707b58614235d6bf6fdb
Last affected
7149b584990dfebba7e8a61519298a89f2593b86
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.3.4"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.10
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.10
v2.2.11
v2.2.12
v2.2.13
v2.2.14
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67595.json"