What’s Vulnerable › Vulnerabilities

CVE-2022-1002: HTML Injection while inviting Guests

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-18 · updated 2026-06-17
• Weakness: CWE-80

Description

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

Affected products

• Mattermost App Framework: before 6.4.0 — fixed in 6.4.0

How to fix

Upgrade to a fixed version: Mattermost App Framework 6.4.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1443567
• https://mattermost.com/security-updates/
• https://hackerone.com/reports/1443567
• https://mattermost.com/security-updates/

Get alerted when CVE-2022-1002 or the next vulnerability affects your stack