USN-8097-2
roundcube regression
USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack.
What each source reports
OSV No score
roundcube regression
USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack.
- Record
USN-8097-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeUbuntu:Pro:20.04:LTS |
before 1.4.3+dfsg.1-1ubuntu0.1~esm7, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2 Show 7 moreShow less1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm6 |
1.4.3+dfsg.1-1ubuntu0.1~esm7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8097-2 is a vulnerability with no CVSS score yet in roundcube, published March 18, 2026. No source lists public exploit code. Fixed in roundcube 1.4.3+dfsg.1-1ubuntu0.1~esm7.