Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-75872 ·
Medium · August 18, 2026

HTML Injection in MailerUp allows attacker-controlled HTML to be delivered in double opt-in verification emails

S0
Secur0 CNA
CVE-2026-75872

Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) in the public subscriber sign-up flow (_send_verification_email and _verification_email_html, backend/apps/forms/views.py), exposed at POST /subscribe/{form_id}/, in MailerUp 1.1.2, which allows an unauthenticated remote attacker to make the application send, to an email address of their choosing and from the sending identity configured by the form owner, a message carrying arbitrary HTML markup, via the request body's first_name field, because that field was taken directly from the unauthenticated request and interpolated raw into the verification email's greeting, which was in turn inserted unescaped into the message's HTML template, unlike the page's own HTML response, which did apply escape() to the same value, and unlike the embed snippet generator _build_embed_html, which already escaped every field reaching HTML. The same request determines the recipient through the email field, so the attacker controls both the injected content and the message's receiver. The fixing commit additionally applies the same escaping to form_obj.title and the _safe_color() validation to form_obj.primary_color, both interpolated raw into that same template and controlled by the form owner. This results in the vulnerable system emitting, from its own legitimate infrastructure, an unauthorized message whose HTML content is chosen by the attacker. The proof of concept demonstrates that the injected markup reaches the received email body unescaped and that a remote image included in it issues a request to the attacker's server when the message is opened.

Vulnerability type (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected versions

MailerUp before 1.1.3 (fixed in 1.1.3 by commit da4aedc, dated 2026-07-15). The sink has been present since the repository's initial commit 404eda9 (2026-06-20) and was present in the v1.0.3, v1.1.0, v1.1.1 and v1.1.2 tags, so tagged releases did ship in a vulnerable state. Version 1.1.3 corresponds to the v1.1.3 tag, which is the fixing commit itself. Versions are read from the VERSION constant in backend/mailerup/settings/base.py and from the version field of frontend/package.json. Default status: unaffected.

Score (CVSS 4.0)

Medium (6.9)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 1.1.3 or higher.

Patch

Commit da4aedc

Credits

  • Nacho García Egea - finder
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Mario Álvarez Fernández - remediation developer Discovery source: External Official record: CVE-2026-75872