PYSEC-2026-2891

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/postorius/PYSEC-2026-2891.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2891
Aliases
Published
2026-07-13T15:15:40.939562Z
Modified
2026-07-13T16:32:58.820403307Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Postorius is vulnerable to XSS
Details

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

References

Affected packages

PyPI / postorius

Package

Name
postorius
View open source insights on deps.dev
Purl
pkg:pypi/postorius

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.3.13

Affected versions

1.*
1.0.0a1
1.0.0a2
1.0.0b1
1.0.0b2
1.0.0b3
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.2.0a1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.3.2
1.3.3rc1
1.3.3rc2
1.3.3
1.3.4rc1
1.3.4
1.3.5
1.3.6b1
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13a1
1.3.13

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/postorius/PYSEC-2026-2891.yaml"