Description
MHonArc 2.5.2 and earlier does not properly filter Javascript from archived e-mail messages, which could allow remote attackers to execute script in web clients by (1) splitting the SCRIPT tag into smaller pieces, (2) including the script in a SRC argument to an IMG tag, or (3) using "&={script}" syntax.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mhonarc | 2.5.11-1 | — |
| Debian 13 | mhonarc | 2.5.11-1 | — |
| Debian 12 | mhonarc | 2.5.11-1 | — |
| Debian 3.0 | mhonarc | 2.5.2-1.1 | DSA-163 |
Advisories 1
- DSA-163 mhonarc - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-163 vendor-advisory
- 20020418 MHonArc v2.5.2 Script Filtering Bypass Vulnerability mailing-list
- http://www.mhonarc.org/MHonArc/CHANGES
- 4546 vdb-entry
- mhonarc-script-filtering-bypass(8894) vdb-entry