Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 14 May 2020 09:11:49 +0200
From: Hanno Böck <>
Subject: Hypermail XSS via attachment

"Hypermail is a free (GPL) program to convert email from Unix mbox
format to html" [1]
It is commonly used to create mailing list archives.

Hypermail contains no validation or sanitation of mail attachments and
provides them as simple files. This means it's trivially vulnerable to
Cross Site Scripting (XSS).

One can simply attach a file to a mail with either no or an .html
extension and it can contain javascript/XSS payloads (e.g.

The developer of Hypermail informed me that he is no longer interested
in Hypermail, thus there will probably be no fix.

This means using hypermail for public mailing list archives is
inherently risky if one runs anything else on the same host that may be
prone to XSS attacks (which is usually everything that includes any
form of authentication).


Hanno Böck

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.