Summary
It was discovered that Postorius did not properly escape HTML in message
subjects when rendering the Held messages pop-up. An attacker could
possibly use this issue to inject arbitrary HTML, resulting in exposure
of sensitive information.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | postorius | 1.3.13-1ubuntu1.1~25.10.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | postorius | 1.3.13-1ubuntu1.1~26.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | postorius | 1.1.2-3ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | postorius | 1.2.4-1ubuntu0.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | postorius | 1.3.5-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | postorius | 1.3.10-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
High 7.2
Postorius is vulnerable to XSS
Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.
References
-
report
https://ubuntu.com/security/CVE-2026-44742