CVE-2025-52557 | THREATINT

Description

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

Reserved 2025-06-18 | Published 2025-06-21 | Updated 2025-06-21 | Assigner GitHub_M

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-1384: Improper Handling of Physical or Environmental Conditions

Product status

= 0.8

affected

References

github.com/...0/Zero/security/advisories/GHSA-34gh-g567-hq85

github.com/Mail-0/Zero/pull/1386

github.com/...ommit/48d1df65b62c9c57897b72b241081f447140342f

cve.org (CVE-2025-52557)

nvd.nist.gov (CVE-2025-52557)

Download JSON