CVE-2026-67595 in VaahCMS
Summary
by MITRE • 07/30/2026
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a sophisticated supply chain attack targeting VaahCMS versions 2.0.0 through 2.3.4 where malicious code was embedded within legitimate email templates used for security OTP delivery. The exploitation occurs through a JavaScript payload that leverages the Blade template engine's rendering capabilities to execute arbitrary code in victim browsers when processing OTP emails. This type of vulnerability aligns with CWE-94 - Improper Control of Generation of Code and maps to ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript within the execution phase of the kill chain.
The technical flaw stems from insufficient input validation and sanitization of template content, allowing attackers to inject malicious JavaScript that executes in the context of legitimate email rendering. The payload demonstrates advanced persistence mechanisms by establishing a WebSocket connection to a hardcoded command-and-control server, enabling real-time communication with attackers. This approach bypasses traditional security controls since the malicious code executes within the trusted email rendering environment. The implementation uses MutationObserver API to dynamically capture password fields and other input elements as they appear in the DOM, making it effective against modern web applications that load content asynchronously.
The operational impact of this vulnerability extends beyond simple credential theft to include comprehensive data exfiltration and remote system control. The keylogger functionality specifically targets password inputs through dynamic DOM observation, while the WhatsApp Web scraping capability indicates targeted reconnaissance of communication channels. The ability to accept remote commands for page redirection or overwriting creates significant risks including phishing attacks, data manipulation, and potential lateral movement within compromised environments. This vulnerability affects any user who receives OTP emails from the affected CMS versions, making it particularly dangerous in enterprise environments where email-based authentication is prevalent.
Security mitigations should focus on immediate template validation and sanitization processes to prevent unauthorized JavaScript injection. Organizations must implement strict content security policies that block WebSocket connections from untrusted origins and restrict MutationObserver usage in email rendering contexts. Network-level controls should monitor for connections to known malicious C2 endpoints, while endpoint detection and response solutions need to identify suspicious JavaScript behavior patterns. The vulnerability highlights the importance of secure template design practices and regular security audits of third-party components, particularly those handling user-facing communication templates that execute code in browser environments. Additionally, implementing proper code review processes and dependency scanning can help prevent similar supply chain attacks from compromising web applications.