A stored cross-site scripting (XSS) vulnerability exists in Roundcube Webmail prior to versions 1.6.17 and 1.7.2. The flaw allows an attacker to inject malicious JavaScript code into a plain-text email message. When a victim opens or previews this message in their authenticated session, the malicious script executes automatically (zero-click), potentially compromising the session or user data. The vulnerability affects multiple specific Debian/Ubuntu package versions of Roundcube as listed. No known exploits in the wild have been reported. No vendor advisory or patch information is provided in the input data.

Successful exploitation results in execution of attacker-controlled JavaScript in the context of the victim's authenticated Roundcube Webmail session. This can lead to session hijacking, theft of sensitive information, or other actions permitted by the victim's privileges within the webmail interface. There is no indication of direct system compromise or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade Roundcube Webmail to versions 1.6.17 or later, or 1.7.2 or later, once official fixes are available. Until then, consider restricting access to untrusted email content or disabling message preview features if feasible.