VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template used for rendering security OTP emails. The payload allows remote attackers to execute unauthorized code in any browser rendering the affected email template with JavaScript enabled. It establishes a WebSocket connection to a hardcoded command-and-control server, installs a password-field keylogger via MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite rendered pages. This represents a supply chain compromise where malicious code was inserted directly into the open-source CMS codebase. The vulnerability has been addressed in a commit to the official GitHub repository.