CVE-2026-67595: Embedded Malicious Code in webreinvent vaahcms
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template used for rendering security OTP emails. This payload enables remote attackers to execute unauthorized code in browsers that render the affected email template with JavaScript enabled. The malicious code establishes a WebSocket connection to a hardcoded command-and-control server, installs a keylogger on password fields, scrapes WhatsApp Web content, and accepts remote commands to manipulate the rendered page.
AI Analysis
Technical Summary
CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4 by embedding a malicious obfuscated JavaScript payload within the Blade template responsible for rendering security OTP emails. When a user views such an email in a JavaScript-enabled browser, the payload activates, establishing a WebSocket connection to a hardcoded command-and-control endpoint. It installs a MutationObserver-based keylogger targeting password fields, scrapes content from WhatsApp Web's DOM, and accepts remote commands to redirect or overwrite the page content. This allows remote attackers to execute unauthorized code and potentially exfiltrate sensitive information or manipulate the user's browsing session.
Potential Impact
The vulnerability allows remote attackers to execute arbitrary code in the context of any browser rendering the affected OTP email template with JavaScript enabled. This includes installing a keylogger to capture password inputs, scraping sensitive WhatsApp Web content, and remotely controlling the rendered page. The impact is critical due to the potential for credential theft, data exfiltration, and session manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided at this time. Until a patch is available, avoid rendering OTP emails from affected VaahCMS versions in JavaScript-enabled browsers or disable JavaScript when viewing such emails.
CVE-2026-67595: Embedded Malicious Code in webreinvent vaahcms
Description
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template used for rendering security OTP emails. This payload enables remote attackers to execute unauthorized code in browsers that render the affected email template with JavaScript enabled. The malicious code establishes a WebSocket connection to a hardcoded command-and-control server, installs a keylogger on password fields, scrapes WhatsApp Web content, and accepts remote commands to manipulate the rendered page.
CVSS v4.0
Score 9.2critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67595 affects VaahCMS versions 2.0.0 through 2.3.4 by embedding a malicious obfuscated JavaScript payload within the Blade template responsible for rendering security OTP emails. When a user views such an email in a JavaScript-enabled browser, the payload activates, establishing a WebSocket connection to a hardcoded command-and-control endpoint. It installs a MutationObserver-based keylogger targeting password fields, scrapes content from WhatsApp Web's DOM, and accepts remote commands to redirect or overwrite the page content. This allows remote attackers to execute unauthorized code and potentially exfiltrate sensitive information or manipulate the user's browsing session.
Potential Impact
The vulnerability allows remote attackers to execute arbitrary code in the context of any browser rendering the affected OTP email template with JavaScript enabled. This includes installing a keylogger to capture password inputs, scraping sensitive WhatsApp Web content, and remotely controlling the rendered page. The impact is critical due to the potential for credential theft, data exfiltration, and session manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided at this time. Until a patch is available, avoid rendering OTP emails from affected VaahCMS versions in JavaScript-enabled browsers or disable JavaScript when viewing such emails.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-29T21:07:39.201Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6a762c9c2644c7f816e03f
Added to database: 07/29/2026, 21:52:44 UTC
Last enriched: 07/29/2026, 22:06:59 UTC
Last updated: 07/29/2026, 23:52:13 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.