CVE-2026-44742
Postorius HTML Message Subject XSS in Held Messages Pop-up
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnu | mailman_postorius | to 1.3.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Cross-Site Scripting (XSS) issue in the Postorius web interface affecting versions 1.3.13 and earlier. Detection involves verifying the version of Postorius in use and checking if the held_messages.js file has the fix applied that escapes HTML in message subjects.
To detect if your system is vulnerable, you can:
- Check the Postorius version installed on your system. Versions 1.3.13 and earlier are vulnerable.
- Inspect the held_messages.js file for the presence of the fix that replaces the .html() method with .text() for rendering message titles.
Example commands to assist detection:
- Check Postorius version (example): postorius --version or check package version via your package manager.
- Search for vulnerable code pattern in held_messages.js: grep -E '\.html\(' /path/to/postorius/static/js/held_messages.js
- Verify if the fix is applied by checking for usage of .text() instead of .html(): grep '\.text\(' /path/to/postorius/static/js/held_messages.js
Additionally, monitoring web traffic for suspicious HTML or script injection attempts in the message subject fields in the Held messages pop-up could help detect exploitation attempts.
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in Postorius, the Mailman 3 web interface for managing mailing lists. Specifically, versions through 1.3.13 do not properly escape HTML in the message subject when rendering it in the Held messages pop-up. This allows an attacker to inject malicious scripts that can be executed in the context of the admin UI.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute arbitrary scripts in the admin interface of Postorius. This can lead to unauthorized actions, data theft, or session hijacking within the mailing list management interface. Since the vulnerability is actively exploited in the wild, systems running vulnerable versions without the fix are at risk.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this Cross-Site Scripting (XSS) vulnerability in Postorius versions 1.3.13 and earlier, you should update Postorius to include the upstream fix merged in January 2025.
- Apply the patch that escapes HTML in the message subject when rendering it in the Held messages pop-up, specifically the fix that replaces the .html() method with .text() in held_messages.js.
- If you are using a distribution that packages Postorius, ensure it includes this security fix or backport the patch yourself.
Since the fix was merged but no official release has been made since, manual patching or upgrading to a version containing the fix is necessary to prevent exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Cross-Site Scripting (XSS) vulnerability in Postorius affects compliance with common standards and regulations such as GDPR or HIPAA.