What is GHSA-vxg2-hhgr-37fx?

GHSA-vxg2-hhgr-37fx is a security advisory published by GitHub Security Advisories with Medium severity. Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

Which CVE IDs does GHSA-vxg2-hhgr-37fx cover?

GHSA-vxg2-hhgr-37fx covers the following CVE IDs: CVE-2026-35540. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vxg2-hhgr-37fx?

GHSA-vxg2-hhgr-37fx has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-vxg2-hhgr-37fx?

GHSA-vxg2-hhgr-37fx affects 1 product, including: composer/roundcube/roundcubemail:\u003e= 1.7-beta, \u003c 1.7-rc5.

GHSA-vxg2-hhgr-37fxMediumCVSS 5.4

Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-35540 →

📋 Description

An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

🎯 Affected products1

composer/roundcube/roundcubemail:>= 1.7-beta, < 1.7-rc5

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2026-35540
https://github.com/roundcube/roundcubemail/commit/27ec6cc9cb25e1ef8b4d4ef39ce76d619caa6870
https://github.com/roundcube/roundcubemail/commit/579b68eff90650a5c782e153debd66c765648942
https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14
https://github.com/advisories/GHSA-vxg2-hhgr-37fx