Arch Linux Security Advisory ASA-202102-27 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26925 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1551 Summary ======= The package roundcubemail before version 1.4.11-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.11-1. # pacman -Syu "roundcubemail>=1.4.11-1" The problem has been fixed upstream in version 1.4.11. Workaround ========== None. Description =========== Roundcube before 1.4.11 allows cross-site scripting (XSS) via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. Impact ====== A remote attacker might be able to perform cross-site scripting via crafted CSS content in a HTML message. References ========== https://roundcube.net/news/2021/02/08/security-update-1.4.11 https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1ba... https://security.archlinux.org/CVE-2021-26925