The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend...
0.69github-advisories · v1 · published 11/3/2026, 12:31:48 PM · modified 11/3/2026, 12:31:53 PM · TLP:CLEAR
offsec.vulnerability
Source evidence ↗Entities
cwe: CWE-79ghsa: GHSA-28j5-vvxh-8mj8cve: CVE-2026-120332
Assessment
Fact summary
low · heuristicThe HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
Technical delta
low · heuristicAutomated delta unavailable (heuristic mode).
Defensive significance
low · heuristicNone identified (heuristic mode).
Extracted text
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.