---
id: CVE-2026-67595
title: >-
  VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via
  security-otp.blade.php
summary: >-
  VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript
  payload embedded in the Blade template responsible for rendering security OTP
  emails, allowing remote attackers to execute unauthorized code in any browser
  th…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-506
vendor: webreinvent
product: vaahcms
affected:
  - vaahcms >= 2.0.0 <= 2.3.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-30T14:21:35.095590Z'
exploitAvailable: true
published: '2026-07-29'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:27.621Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-67595'
references:
  - url: 'https://github.com/webreinvent/vaahcms/pull/317'
    label: Pull Request
  - url: >-
      https://github.com/webreinvent/vaahcms/commit/8d7898f7a385a5fade1180a9b664ff158d873129
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/vaahcms-malicious-javascript-supply-chain-via-security-otp-blade-php
tags:
  - cve.org
  - exploit-available
epss: 0.00763
epssPercentile: 0.53407
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/IlhomjonR/CVE-2026-67595'
  checkedAt: '2026-09-25T08:21:08.395Z'
ingestedAt: '2026-09-24T15:45:56.718Z'
---

## Overview

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page.

## Affected

- `vaahcms >= 2.0.0 <= 2.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.