High-severity CVE-2026-67595 affects VaahCMS versions 2.0.0 to 2.3.4

## Overview CVE-2026-67595 is a high-severity vulnerability affecting VaahCMS versions 2.0.0 through 2.3.4. This flaw involves a malicious obfuscated JavaScript payload embedded in the Blade template used for rendering security OTP emails. Attackers can exploit this vulnerability to execute unauthorized code in browsers that render the affected email template with JavaScript enabled. ## Technical Details The malicious payload establishes a WebSocket connection to a hardcoded command-and-control endpoint. It also installs a password-field keylogger using MutationObserver to capture dynamically added inputs. Additionally, the payload can scrape WhatsApp Web DOM content and accepts remote commands that can redirect or overwrite the rendered page. ## Impact Successful exploitation of CVE-2026-67595 allows remote attackers to execute arbitrary code in the context of the user’s browser. This can lead to unauthorized access to sensitive information, including login credentials and other personal data. The vulnerability poses a significant risk to users who interact with the compromised email templates. ## Mitigation Defenders should upgrade to the latest version of VaahCMS immediately to mitigate the risk associated with this vulnerability. It is crucial to review and sanitize email templates to remove any embedded JavaScript code. Organizations should also educate users about the risks of interacting with potentially compromised emails.