This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Alinto SOGo 5.12.7. Specifically, SVG content embedded in the description field of ICS calendar invitation files includes an onrepeat event handler that is not properly sanitized before rendering in the webmail interface. This allows remote attackers to execute arbitrary JavaScript code in the context of an authenticated user's browser session when the malicious calendar invite is viewed. The impact includes potential mailbox compromise, data theft, and session hijacking. The CVSS 3.1 base score is 6.1 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's webmail session. This can lead to unauthorized mailbox access, theft of emails and contacts, session hijacking, and other actions available to the authenticated user. The vulnerability affects confidentiality and integrity with low impact, and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening ICS calendar invitations from untrusted sources. No official mitigation or workaround has been provided by the vendor at this time.