CVE-2026-73524: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cypht-org cypht

CVE-2026-73524 is a cross-site scripting vulnerability affecting cypht-org's cypht software versions prior to 2.12.2. The vulnerability exists in the contacts module where the sanitization logic for the FROM email header removes only the first occurrence of each angle bracket character, allowing additional angle brackets to remain. Attackers can craft emails with malicious scripts embedded in these angle brackets, which execute in the victim's browser when the user opens the message and uses the Add Local Contacts feature.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable contacts module. This can lead to session hijacking, information disclosure, or other script-based attacks within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening emails and avoid using the Add Local Contacts function with untrusted messages.