CVE-2025-52557: Mail-0 Zero XSS Vulnerability

CVE-2025-52557 Overview

CVE-2025-52557 is a Cross-Site Scripting (XSS) vulnerability in Mail-0's Zero, an open-source email solution. In version 0.8, an attacker can craft an email containing JavaScript that executes within the recipient's browser session. The flaw stems from improper sanitization of email content rendered in the mail client interface. Successful exploitation enables session hijacking, allowing attackers to take over authenticated user sessions. The maintainers addressed the issue in version 0.81 by introducing DOMPurify-based sanitization. The vulnerability is classified under [CWE-1384] (Improper Handling of Physical or Environmental Conditions) per the assigned weakness category.

Critical Impact
An attacker can hijack authenticated Mail-0 Zero user sessions by sending a single crafted email that executes arbitrary JavaScript in the victim's browser.

Affected Products

Mail-0 Zero version 0.8
Open-source self-hosted Mail-0 Zero deployments
Any downstream forks based on version 0.8 without the upstream fix

Discovery Timeline

2025-06-21 - CVE-2025-52557 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-52557

Vulnerability Analysis

Mail-0 Zero renders incoming email content within an iframe component (mail-iframe.tsx) without sufficient HTML sanitization. An attacker crafts an email containing malicious HTML or JavaScript payloads. When the victim opens the message, the embedded script executes in the context of the Mail-0 Zero web application. Because the script runs in the authenticated origin, it can read session tokens, authentication cookies, and local storage values. The attacker can exfiltrate these credentials to a remote server, enabling session hijacking and full account takeover. The attack requires no privileges and only minimal user interaction — opening the malicious email.

Root Cause

The root cause is missing HTML sanitization in the email rendering pipeline. The component apps/mail/components/mail/mail-iframe.tsx rendered untrusted email body content directly without filtering active content such as <script> tags, event handlers, or javascript: URLs. The patch introduces the DOMPurify library to strip dangerous constructs before rendering. A secondary change in apps/mail/app/(routes)/mail/page.tsx converts clientLoader to a server-side loader for the redirect, reducing client-side attack surface.

Attack Vector

Exploitation is network-based and remote. An attacker sends a specially crafted email to a Mail-0 Zero user. When the victim previews or opens the message, the unsanitized payload executes JavaScript in the application origin and exfiltrates session data.

text

// Security patch in apps/mail/components/mail/mail-iframe.tsx
 import { useSettings } from '@/hooks/use-settings';
 import { useTranslations } from 'use-intl';
 import { useTheme } from 'next-themes';
+import DOMPurify from 'dompurify';
 import { cn } from '@/lib/utils';
 import { toast } from 'sonner';

// Security patch in apps/mail/app/(routes)/mail/page.tsx
 import { redirect } from 'react-router';

-export function clientLoader() {
+export function loader() {
   throw redirect(`/mail/inbox`);
 }

Source: GitHub Commit 48d1df6

Detection Methods for CVE-2025-52557

Indicators of Compromise

Inbound emails containing <script> tags, inline on* event handlers, or javascript: URIs in HTML bodies
Outbound HTTP requests from browser sessions to unknown domains immediately after a user opens an email
Unexpected reuse of session cookies or JWT tokens from new IP addresses or user agents
Unusual mailbox activity such as new filters, forwarding rules, or sent messages the user did not initiate

Detection Strategies

Inspect email rendering pipelines and proxy logs for HTML payloads containing executable content reaching Mail-0 Zero users
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from the mail iframe
Correlate authentication events with browser telemetry to identify session token reuse from anomalous locations

Monitoring Recommendations

Monitor the running version of Mail-0 Zero in inventory systems and alert on any host still serving version 0.8
Log and review DOM mutations or iframe srcdoc writes within the mail client at the application layer
Track outbound network connections from end-user browsers to non-allowlisted domains during mail rendering sessions

How to Mitigate CVE-2025-52557

Immediate Actions Required

Upgrade all Mail-0 Zero deployments from version 0.8 to version 0.81 or later
Invalidate active user sessions and rotate authentication tokens after upgrading
Review mailbox audit logs for suspicious rules, forwarders, or sent messages created since deploying version 0.8
Notify users to report any unexpected behavior when opening recent emails

Patch Information

The fix is delivered in Mail-0 Zero version 0.81 via the hotfix tracked in Pull Request #1386 and committed as 48d1df6. The patch introduces DOMPurify sanitization in mail-iframe.tsx and hardens the mail route loader. See the GitHub Security Advisory GHSA-34gh-g567-hq85 for full advisory details.

Workarounds

Restrict access to Mail-0 Zero behind a VPN or SSO gateway until the upgrade is applied
Configure a strict Content Security Policy disallowing inline scripts and unsafe-eval on the Mail-0 Zero origin
Filter inbound email at the gateway to strip or quarantine messages containing active HTML content such as <script> tags and event handlers

bash

# Upgrade Mail-0 Zero to the patched release
git fetch --tags
git checkout v0.81
pnpm install
pnpm build
pnpm start

# Verify DOMPurify is present in the patched iframe component
grep -n "DOMPurify" apps/mail/components/mail/mail-iframe.tsx