VulnerabilityDeferred

CVE-2025-52557

In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization.

HIGH 8.6EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-1384
Source: security-advisories@github.com

References

https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f
https://github.com/Mail-0/Zero/pull/1386
https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.