Postorius versions through 1.3.13 suffer from improper neutralization of input during web page generation (CWE-79), specifically failing to escape HTML in the message subject field when displaying Held messages. This results in a cross-site scripting (XSS) vulnerability that could allow remote attackers to execute arbitrary scripts in the context of the victim's browser without requiring user interaction. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no impact on availability. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or manipulation of data viewed by the user. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits have been reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with Held messages in Postorius and consider applying temporary mitigations such as input sanitization or disabling the affected feature if feasible.