Loading vulnerability…
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard (non-administrative) privileges to inject arbitrary HTML into system-generated email notifications by crafting malicious content in the post field of stream activity notes. The vulnerability exists because server-side Handlebars templates render the post field using unescaped triple-brace syntax, the Markdown processor preserves inline HTML by default, and the rendering pipeline explicitly skips sanitization for fields present in additionalData, creating a path where attacker-controlled HTML is accepted, stored, and rendered directly into emails without any escaping. Since the emails are sent using the system's configured SMTP identity (such as an administrative sender address), the injected content appears fully trusted to recipients, enabling phishing attacks, user tracking via embedded resources like image beacons, and UI manipulation within email content. The @mention feature further increases the impact by allowing targeted delivery of malicious emails to specific users. This issue has been fixed in version 9.3.4.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a small standalone Python proof-of-concept exploit for CVE-2026-33657 affecting EspoCRM 9.3.3. It contains one code file (CVE-2026-33657.py), a README with usage and lab verification guidance, and an MIT license. The exploit is not part of a larger framework. The Python script uses requests and argparse to perform an authenticated attack flow against EspoCRM's REST API. Its main capabilities are: validating the supplied base URL, authenticating with provided credentials, optionally fingerprinting the target version via /api/v1/App/user, constructing either a default or fully custom HTML payload, and submitting that payload in a new Note via /api/v1/Note. It supports two notification-targeting modes: mention-based targeting (--mention) and direct user targeting (--target-user-id / --target-user-name). After submission, it parses the API response to confirm the Note was created, the payload was stored, and notification recipients were identified. The exploit does not deliver shell access or remote code execution. Its purpose is to demonstrate stored HTML injection in EspoCRM email notifications: attacker-controlled HTML placed in a Note is later rendered into notification emails when the SendEmailNotifications job/cron runs. The default payload includes an external image URL suitable for tracking and a clickable link, while custom payloads can be supplied directly. Because the exploit includes a working payload and end-to-end API interaction but is still a standalone PoC rather than a framework-integrated module, OPERATIONAL is the best maturity fit. Fingerprintable endpoints are limited and clear: /api/v1/App/user for version detection and /api/v1/Note for malicious Note creation. The README also documents example attacker infrastructure such as tracking URLs and a javascript: URI in sample HTML. Overall, this repository is a focused authenticated exploit PoC for demonstrating stored HTML injection into EspoCRM-generated email notifications, not a detection-only script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.