GHSA-r7c9-7pjq-hmm8

Source

https://github.com/advisories/GHSA-r7c9-7pjq-hmm8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-r7c9-7pjq-hmm8/GHSA-r7c9-7pjq-hmm8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r7c9-7pjq-hmm8

Aliases

Published

2026-05-07T21:30:29Z

Modified

2026-07-13T16:42:24Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Postorius is vulnerable to XSS

Details

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-12T16:20:35Z",
    "nvd_published_at":  "2026-05-07T19:16:02Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / postorius

Package

Name: postorius; View open source insights on deps.dev
Purl: pkg:pypi/postorius

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.3.13

Affected versions

1.*

1.0.0a1

1.0.0a2

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.2.0a1

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3rc1

1.3.3rc2

1.3.3

1.3.4rc1

1.3.4

1.3.5

1.3.6b1

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.11

1.3.12

1.3.13a1

1.3.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-r7c9-7pjq-hmm8/GHSA-r7c9-7pjq-hmm8.json"