Loading vulnerability…
CVE-2026-54433 is a stored cross-site scripting vulnerability in Roundcube Webmail affecting versions before 1.6.17 and 1.7.x before 1.7.2. The flaw is in the application's plain-text email rendering path, where attacker-controlled content in a crafted plain-text email message can be rendered in a way that leads to execution of injected JavaScript in the webmail interface. Because the payload executes when the victim merely opens or previews the message, exploitation is considered zero-click within the mail-viewing workflow and occurs in the context of the victim's authenticated Roundcube session.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a real exploit PoC for CVE-2026-54433, a stored XSS in Roundcube’s plain-text email renderer. The main exploit file is `cve-2026-54433-poc.py`, a self-contained Python script using only the standard library. It validates attacker-supplied sender/recipient/collector parameters, builds a malicious `text/plain` RFC 5322 email, embeds a whitespace-free HTML/JavaScript trigger that abuses Roundcube’s vulnerable auto-linking of email-like strings, and either writes the message to disk (`--generate-only`) or sends it via SMTP with plain, STARTTLS, or SSL modes. After sending, it can optionally poll a collector API or Webhook.site to confirm exploitation. The exploit capability is bounded but active: when the victim opens or previews the crafted message while authenticated to an affected Roundcube instance, JavaScript executes in the Roundcube origin. The payload does not attempt cookie theft or credential harvesting; instead it performs same-origin mailbox access to enumerate older messages up to a configurable limit, extracts the first older non-PoC subject it finds, and POSTs `subject`, `origin`, and `task` to a collector endpoint under `/capture/<marker>`. This demonstrates authenticated impact from an unauthenticated email sender. `collector.py` is supporting infrastructure, not the exploit itself. It is a minimal HTTP server exposing `/capture/<marker>` to receive GET/POST callbacks, `/view` to display captured evidence in a browser, and `/status` to return JSON for automation. It defaults to `127.0.0.1:8081`. The `lab/` directory provides a disposable end-to-end Docker environment for validation. `lab/run.sh` builds a Dovecot IMAP container, launches Roundcube, the collector, and a headless Chrome container, injects both a benign existing message and the generated trigger email into a synthetic mailbox, then uses `lab/cdp-e2e.mjs` to log into Roundcube, open the trigger message, and verify whether the callback occurred. `lab/demo.sh` exposes Roundcube and the collector on loopback for manual demonstration. `lab/record-browser-demo.mjs`, `record-browser-demo.sh`, and `lab/terminal-demo.sh` automate a visual recording workflow, including optional Webhook.site use. `verify.sh` performs offline integrity checks and can optionally run both vulnerable and fixed Docker controls. Overall purpose: provide a configurable, reproducible exploit PoC plus validation tooling for demonstrating that a crafted plain-text email can trigger stored XSS in affected Roundcube versions and read limited same-origin mailbox data from an authenticated victim session.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical zero-click stored XSS vulnerability in Roundcube Webmail.
A critical zero-click stored XSS vulnerability in Roundcube’s plain-text rendering engine that allows malicious script execution when a victim views an email in plain-text mode.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.