GHSA-r7c9-7pjq-hmm8

Postorius is vulnerable to XSS

Source: GitHub Advisory Database (reviewed) High CVE-2026-44742

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	postorius	<= 1.3.13	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-44742 advisory
https://gitlab.com/mailman/postorius package
https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b web
https://gitlab.com/mailman/postorius/-/issues/620 web
https://gitlab.com/mailman/postorius/-/merge_requests/972 web
https://www.openwall.com/lists/oss-security/2026/05/07/3 web