p PatchFirst

CVE-2026-44742

CVE-2026-44742

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

CVSS 7.2 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • postorius

    Versions
    • ≥ 0, ≤ 1.3.13: Affected (semver)

    No fix published

  • postorius Debian:12

    Versions
    • 1.3.8-3
    Affected ranges
    • ECOSYSTEM: < 1.3.8-3+deb12u1

    Update to 1.3.8-3+deb12u1

  • postorius Debian:13

    Versions
    • 1.3.13-1
    Affected ranges
    • ECOSYSTEM: < 1.3.13-1+deb13u1

    Update to 1.3.13-1+deb13u1

  • postorius Debian:14

    Versions
    • 1.3.13-1
    • 1.3.13-2
    • 1.3.13-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postorius PyPI

    Versions
    • 1.0.0
    • 1.0.0a1
    • 1.0.0a2
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0b3
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.2.0
    • 1.2.0a1
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.3.0
    • 1.3.1
    • 1.3.10
    • 1.3.11
    • 1.3.12
    • 1.3.13
    • 1.3.13a1
    • 1.3.2
    • 1.3.3
    • 1.3.3rc1
    • 1.3.3rc2
    • 1.3.4
    • 1.3.4rc1
    • 1.3.5
    • 1.3.6
    • 1.3.6b1
    • 1.3.7
    • 1.3.8
    • 1.3.9
    Affected ranges
    • ECOSYSTEM: ≤ 1.3.13

    No fix published

  • postorius Ubuntu:Pro:18.04:LTS

    Versions
    • 1.1.0-1
    • 1.1.1-1
    • 1.1.2-1
    • 1.1.2-2
    • 1.1.2-3
    • 1.1.2-3ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.1.2-3ubuntu0.1+esm1

    Update to 1.1.2-3ubuntu0.1+esm1

  • postorius Ubuntu:Pro:20.04:LTS

    Versions
    • 1.2.4-1
    • 1.2.4-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.2.4-1ubuntu0.1+esm1

    Update to 1.2.4-1ubuntu0.1+esm1

  • postorius Ubuntu:Pro:22.04:LTS

    Versions
    • 1.3.4-2
    • 1.3.5-1
    Affected ranges
    • ECOSYSTEM: < 1.3.5-1ubuntu0.1~esm1

    Update to 1.3.5-1ubuntu0.1~esm1

  • postorius Ubuntu:Pro:24.04:LTS

    Versions
    • 1.3.8-3
    • 1.3.10-1
    Affected ranges
    • ECOSYSTEM: < 1.3.10-1ubuntu0.1~esm1

    Update to 1.3.10-1ubuntu0.1~esm1

  • postorius Ubuntu:25.10

    Versions
    • 1.3.13-1
    • 1.3.13-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.3.13-1ubuntu1.1~25.10.1

    Update to 1.3.13-1ubuntu1.1~25.10.1

  • postorius Ubuntu:26.10

    Versions
    • 1.3.13-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postorius Ubuntu:26.04:LTS

    Versions
    • 1.3.13-1ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.3.13-1ubuntu1.1~26.04.1

    Update to 1.3.13-1ubuntu1.1~26.04.1

Original sources

Check your server →