Postorius is vulnerable to XSS

MÉDIO 6.1CVE-2026-44742 · GHSA-r7c9-7pjq-hmm8 · PYSEC-2026-2891 · Published 07/05/2026 · updated 17/06/2026

Em resumo

CVE-2026-44742 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta postorius, postorius (postorius project).
Chance de exploração nos próximos 30 dias (EPSS): 0.24%, maior que 14.8% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
postorius PyPI	`≤ 1.3.13`	No fix yet
postorius postorius_project	`≤ 1.3.13`	No fix yet

Description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

NVD description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

References

nvd.nist.gov/vuln/detail/CVE-2026-44742 · ADVISORY
gitlab.com/mailman/postorius · PACKAGE
gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b · WEB
gitlab.com/mailman/postorius/-/issues/620 · WEB
gitlab.com/mailman/postorius/-/merge_requests/972 · WEB
openwall.com/lists/oss-security/2026/05/07/3 · WEB
lists.debian.org/debian-lts-announce/2026/05/msg00045.html
pypi.org/project/postorius · PACKAGE
GitHub Advisory GHSA-r7c9-7pjq-hmm8 · ADVISORY

Mais vulnerabilidades de postorius

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

postorius

PyPI

≤ 1.3.13

No fix yet

postorius

postorius_project

≤ 1.3.13

No fix yet

Description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

NVD description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.