CVE-2025-52557

Description

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

Is your site exposed to CVE-2025-52557?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-1384 CWE-1384

References

Other References

https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f https://github.com/Mail-0/Zero/pull/1386 https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85

Frequently Asked Questions

What is CVE-2025-52557? +

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

How do I check if I'm vulnerable to CVE-2025-52557? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-39355 6.5

Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of …

CVE-2026-49325 4.6

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year …