{"id":"CVE-2026-44742","aliases":["DEBIAN-CVE-2026-44742","EUVD-2026-28415","GHSA-r7c9-7pjq-hmm8","PYSEC-2026-2891","UBUNTU-CVE-2026-44742","USN-8323-1","openSUSE-SU-2026:11539-1"],"status":"published","title":"Postorius is vulnerable to XSS","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00237,"percentile":0.1484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-07T18:09:20Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Debian:12","package":"postorius","fixed_in":["1.3.8-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postorius","fixed_in":["1.3.13-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postorius","fixed_in":["1.1.2-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postorius","fixed_in":["1.2.4-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postorius","fixed_in":["1.3.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postorius","fixed_in":["1.3.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"postorius","fixed_in":["1.3.13-1ubuntu1.1~25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"postorius","fixed_in":["1.3.13-1ubuntu1.1~26.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-postorius","fixed_in":["1.3.13-8.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-3+deb12u1"}]}],"versions":["1.3.8-3"]},{"source":"osv","ecosystem":"Debian:13","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-1+deb13u1"}]}],"versions":["1.3.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.13-1","1.3.13-2","1.3.13-3"]},{"source":"osv","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.13"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.2.0a1","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.13a1","1.3.2","1.3.3","1.3.3rc1","1.3.3rc2","1.3.4","1.3.4rc1","1.3.5","1.3.6","1.3.6b1","1.3.7","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.13"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.2.0a1","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.13a1","1.3.2","1.3.3","1.3.3rc1","1.3.3rc2","1.3.4","1.3.4rc1","1.3.5","1.3.6","1.3.6b1","1.3.7","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3ubuntu0.1+esm1"}]}],"versions":["1.1.0-1","1.1.1-1","1.1.2-1","1.1.2-2","1.1.2-3","1.1.2-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1+esm1"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1ubuntu0.1~esm1"}]}],"versions":["1.3.4-2","1.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-1ubuntu0.1~esm1"}]}],"versions":["1.3.8-3","1.3.10-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-1ubuntu1.1~25.10.1"}]}],"versions":["1.3.13-1","1.3.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-1ubuntu1.1~26.04.1"}]}],"versions":["1.3.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3ubuntu0.1+esm1"}]}],"versions":["1.1.0-1","1.1.1-1","1.1.2-1","1.1.2-2","1.1.2-3","1.1.2-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1+esm1"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1ubuntu0.1~esm1"}]}],"versions":["1.3.4-2","1.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.10-1ubuntu0.1~esm1"}]}],"versions":["1.3.8-3","1.3.10-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-1ubuntu1.1~25.10.1"}]}],"versions":["1.3.13-1","1.3.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-1ubuntu1.1~26.04.1"}]}],"versions":["1.3.13-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13-8.1"}]}]}],"products":[{"vendor":"postorius project","product":"postorius"},{"vendor":"postorius_project","product":"postorius"}],"references":[{"url":"https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b","tags":["Patch","fix","web","report"]},{"url":"https://gitlab.com/mailman/postorius/-/merge_requests/972","tags":["Issue Tracking","Patch","fix","web","report"]},{"url":"https://gitlab.com/mailman/postorius/-/issues/620","tags":["Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/07/3","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00045.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44742","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r7c9-7pjq-hmm8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44742.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44742","tags":["advisory"]},{"url":"https://gitlab.com/mailman/postorius","tags":["package"]},{"url":"https://pypi.org/project/postorius","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-44742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44742","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8323-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44742","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-44742","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T18:09:20.069Z","modified":"2026-05-25T23:25:05.656Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-28415","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T18:09:20Z","modified":"2026-05-25T23:25:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:21:08.174412Z"}],"ghsa":[{"id":"GHSA-r7c9-7pjq-hmm8","title":"Postorius is vulnerable to XSS","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T21:30:29Z","modified":"2026-05-12T16:20:38Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-44742","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T19:16:02.5Z","modified":"2026-06-17T10:51:17.55Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-44742","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T18:09:20.069Z","modified":"2026-10-28T02:30:29.210499545Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44742","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T19:16:02.5Z","modified":"2026-10-01T03:03:14.995407421Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-r7c9-7pjq-hmm8","title":"Postorius is vulnerable to XSS","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T21:30:29Z","modified":"2026-07-13T16:42:24.933667417Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"PYSEC-2026-2891","title":"Postorius is vulnerable to XSS","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-07-13T15:15:40.939562Z","modified":"2026-07-13T16:32:58.820403307Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-44742","description":"Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.","status":"published","published":"2026-05-07T19:16:00Z","modified":"2026-10-17T12:58:21.129322459Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"openSUSE-SU-2026:11539-1","title":"postorius-1.3.13-8.1 on GA media","description":"These are all security issues fixed in the postorius-1.3.13-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-08-19T18:23:34.392735927Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"USN-8323-1","title":"postorius vulnerability","description":"It was discovered that Postorius did not properly escape HTML in message\nsubjects when rendering the Held messages pop-up. An attacker could\npossibly use this issue to inject arbitrary HTML, resulting in exposure\nof sensitive information.","status":"published","published":"2026-05-27T13:28:20Z","modified":"2026-05-27T18:14:18.626211543Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}