Back to KEVs

CVE-2026-44742

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May...

Basic Information

CVE State
PUBLISHED
Reserved Date
May 07, 2026
Published Date
May 07, 2026
Last Updated
May 25, 2026
Vendor
Postorius project
Product
Postorius
Description
Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

CVSS Scores

CVSS v3.1

7.2 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC Information

Exploitation
none
Automatable
Yes
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2026-06-01 13:26:33 UTC) Source

References

https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b https://gitlab.com/mailman/postorius/-/merge_requests/972 https://gitlab.com/mailman/postorius/-/issues/620 https://www.openwall.com/lists/oss-security/2026/05/07/3

Known Exploited Vulnerability Information

Source Added Date
CVE 2026-06-01 13:26:33 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel