Skip to content
Heist/ feed
Back to feed
Medium

Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Type: advisorySources: OSV

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-73524
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 14:11 UTC · Revision 1

Source evidence

Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

core-osv · Original source

Published 1 Sept 2026, 20:44 UTC

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

osv:CVE-2026-73524
Complete source record
{
  "id": "17a604967ca2030d863ec949b7a174e4195ce3ade2b3b9bf1036ef85b2bc49dd",
  "url": "https://osv.dev/vulnerability/CVE-2026-73524",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module",
    "summary": "Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.",
    "evidence": "osv:CVE-2026-73524",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-73524",
      "aliases": [
        "CVE-2026-73524"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cypht-org/cypht",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "fbaf979c3740a6e0f72e3a6c96e4a5102aae2133"
                },
                {
                  "fixed": "372343783b3d21c12f74bb88d0eef36c1579c062"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.12.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "fbaf979c3740a6e0f72e3a6c96e4a5102aae2133"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.12.2"
                  },
                  {
                    "range": [
                      {
                        "fixed": "372343783b3d21c12f74bb88d0eef36c1579c062"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.12.0",
            "v2.11.0",
            "v2.5.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.1",
            "v2.0.0",
            "v1.3.0-rc1",
            "v1.1.0-rc1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73524.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.206354792Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73524.json",
        "https://github.com/cypht-org/cypht/releases/tag/v2.12.2",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73524",
        "https://www.vulncheck.com/advisories/cypht-xss-via-from-email-header-in-contacts-module",
        "https://github.com/cypht-org/cypht/pull/2072",
        "https://github.com/cypht-org/cypht/commit/372343783b3d21c12f74bb88d0eef36c1579c062",
        "https://github.com/cypht-org/cypht"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73524.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73524",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 496257,
  "published_at": "2026-09-01T20:44:51.262+00:00"
}