Hoppscotch Stored Cross-Site Scripting Vulnerability in Team Member Tooltip

A stored cross-site scripting vulnerability has been identified in Hoppscotch versions prior to 2026.3.0. The issue resides in the team member overflow tooltip within shared workspaces, where user-controlled display names were rendered as HTML. This allowed a workspace member to inject JavaScript that would execute in the browser of other members interacting with the tooltip. The vulnerability affects Hoppscotch Cloud and self-hosted deployments that expose the shared workspace member stack.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts execute in the context of other users' sessions, potentially leading to session hijacking or DOM manipulation.

Remediation

Users can update to Hoppscotch version 2026.3.0 or later, where this vulnerability has been patched.