What is GHSA-r7c9-7pjq-hmm8?

GHSA-r7c9-7pjq-hmm8 is a security advisory published by GitHub Security Advisories with High severity. Postorius is vulnerable to XSS

Which CVE IDs does GHSA-r7c9-7pjq-hmm8 cover?

GHSA-r7c9-7pjq-hmm8 covers the following CVE IDs: CVE-2026-44742. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r7c9-7pjq-hmm8?

GHSA-r7c9-7pjq-hmm8 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-r7c9-7pjq-hmm8?

GHSA-r7c9-7pjq-hmm8 affects 1 product, including: pip/postorius:\u003c= 1.3.13.

GHSA-r7c9-7pjq-hmm8HighCVSS 7.2

Postorius is vulnerable to XSS

Vendor

GitHub Security Advisories

Published

May 7, 2026

Last Modified

May 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-44742 →

📋 Description

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

🎯 Affected products1

pip/postorius:<= 1.3.13

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-44742
https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b
https://gitlab.com/mailman/postorius/-/issues/620
https://gitlab.com/mailman/postorius/-/merge_requests/972
https://www.openwall.com/lists/oss-security/2026/05/07/3
https://github.com/advisories/GHSA-r7c9-7pjq-hmm8