What’s Vulnerable › Vulnerabilities

CVE-2025-52557: Mail-0 Zero Session Hijacking Via Email

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-21 · updated 2026-06-17
• Weakness: CWE-1384

Description

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

Affected products

• Mail-0 Zero: = 0.8

References

• https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f
• https://github.com/Mail-0/Zero/pull/1386
• https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85

Get alerted when CVE-2025-52557 or the next vulnerability affects your stack