CVE-2025-52557: Mail-0 Zero XSS Vulnerability

CVE-2025-52557 Overview

CVE-2025-52557 is a stored cross-site scripting (XSS) vulnerability in Mail-0's Zero, an open-source email solution. Version 0.8 fails to sanitize email content properly, allowing an attacker to craft an email containing JavaScript that executes when the recipient views the message. Successful exploitation enables session hijacking through theft of authentication tokens and cookies. The maintainers patched the flaw in version 0.81 by introducing DOMPurify sanitization in the mail rendering iframe. The vulnerability is tracked under CWE-1384 and was disclosed through the project's GitHub Security Advisory.

Critical Impact

A crafted email can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking and account takeover of Mail-0 Zero users.

Affected Products

• Mail-0 Zero version 0.8
• Earlier vulnerable releases of Mail-0 Zero through 0.80
• Self-hosted deployments of Mail-0 Zero prior to the 0.81 hotfix

Discovery Timeline

• 2025-06-21 - CVE-2025-52557 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-52557

Vulnerability Analysis

The vulnerability is a client-side script injection flaw in the email rendering component of Mail-0 Zero. When the application renders HTML email content inside its mail iframe, it does not sanitize untrusted markup before injection. Attackers craft an email message containing <script> tags or event-handler attributes that execute JavaScript inside the victim's authenticated browser context. Because the script runs with the user's session, the attacker can read or exfiltrate session tokens, manipulate the DOM, and perform actions on behalf of the victim. The advisory categorizes the issue under CWE-1384, which covers improper handling of physical or environmental conditions but is mapped here to improper neutralization of email content.

Root Cause

The mail-iframe.tsx component rendered remote HTML email bodies without invoking an HTML sanitizer. No allowlist filtered dangerous tags, attributes, or javascript: URIs. The patch in version 0.81 adds DOMPurify to strip unsafe markup before rendering, and adjusts the route loader in apps/mail/app/(routes)/mail/page.tsx to enforce a server-side redirect.

Attack Vector

Exploitation requires the attacker to send an email to a Mail-0 Zero user and the victim to open the message. The attack is network-based, requires no authentication, and depends on user interaction to view the malicious email.

 import { useSettings } from '@/hooks/use-settings';
 import { useTranslations } from 'use-intl';
 import { useTheme } from 'next-themes';
+import DOMPurify from 'dompurify';
 import { cn } from '@/lib/utils';
 import { toast } from 'sonner';

Source: GitHub Commit 48d1df6 — the patch introduces DOMPurify into the mail-iframe.tsx rendering pipeline to sanitize email HTML before it reaches the DOM.

 import { redirect } from 'react-router';
 
-export function clientLoader() {
+export function loader() {
   throw redirect(`/mail/inbox`);
 }

Source: GitHub Commit 48d1df6 — the patch moves the redirect from a client loader to a server-side loader in apps/mail/app/(routes)/mail/page.tsx, removing client-rendered surfaces that could leak script execution.

Detection Methods for CVE-2025-52557

Indicators of Compromise

• Inbound email messages containing <script> tags, inline event handlers such as onerror or onload, or javascript: URIs inside the HTML body.
• Outbound requests from user browsers to unfamiliar domains immediately after opening an email in Mail-0 Zero.
• Unexpected session-cookie access patterns or duplicate authenticated sessions originating from new IP addresses.

Detection Strategies

• Inspect mail-server logs for messages with HTML bodies that include dangerous tags or attributes before delivery to Mail-0 Zero mailboxes.
• Deploy a Content Security Policy in the Mail-0 Zero frontend and monitor CSP violation reports for inline-script execution attempts.
• Correlate web-application access logs for session tokens used from multiple geographic locations within short time windows.

Monitoring Recommendations

• Enable verbose logging on the Mail-0 Zero application server and forward events to a centralized SIEM for analysis.
• Alert on access to authentication-cookie endpoints from JavaScript contexts that historically did not request them.
• Track the deployed Mail-0 Zero version across all instances and flag any host still running 0.8 or earlier.

How to Mitigate CVE-2025-52557

Immediate Actions Required

• Upgrade all Mail-0 Zero deployments to version 0.81 or later, which contains the DOMPurify-based sanitization fix.
• Invalidate active user sessions after upgrading to force re-authentication and revoke any tokens potentially captured by a prior exploit.
• Review inbox contents for suspicious HTML emails received before patching and quarantine messages containing executable markup.

Patch Information

The fix is delivered in Mail-0 Zero version 0.81 via Pull Request #1386 and commit 48d1df65b62c9c57897b72b241081f447140342f. The patch adds DOMPurify sanitization to mail-iframe.tsx and converts the mail route loader to a server-side loader function. Refer to the GitHub Security Advisory GHSA-34gh-g567-hq85 for full advisory details.

Workarounds

• Restrict access to the Mail-0 Zero web interface to trusted networks until the upgrade can be applied.
• Enforce a strict Content Security Policy that blocks inline scripts and unsafe-inline styles in the application frontend.
• Configure upstream mail filters to strip <script> tags and JavaScript event handlers from inbound HTML email bodies.

# Upgrade Mail-0 Zero to the patched release
git fetch --tags
git checkout v0.81
pnpm install
pnpm build
pnpm start