Loading vulnerability…
Stored XSS in Roundcube Webmail plain-text rendering
CVE-2026-54433 is a stored cross-site scripting vulnerability in the plain-text email rendering engine of Roundcube Webmail before 1.6.17 and in the 1.7.x branch before 1.7.2. A crafted plain-text email can cause attacker-controlled JavaScript to execute in the victim's authenticated Roundcube session when the message is opened or previewed. Described as zero-click, exploitation requires no interaction with links or attachments beyond displaying the message.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the victim's authenticated webmail context, potentially enabling session compromise, credential theft, unauthorized mailbox access, and actions performed with the victim's privileges.
If you can’t patch tonight, do this now.
No separate workaround or temporary mitigation is documented. Viewing email in plain-text mode does not avoid this vulnerability because the affected component is the plain-text renderer.
Patch, then assume compromise.
Upgrade Roundcube Webmail to 1.6.17 or later in the 1.6 branch, or 1.7.2 or later in the 1.7 branch. For Debian stable (trixie), install roundcube 1.6.17+dfsg-0+deb13u1 or a later fixed package. Back up application data before upgrading.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.