CVE-2026-59994: EspoCRM Email Notification XSS Vulnerability

CVE-2026-59994 Overview

CVE-2026-59994 is an HTML injection vulnerability in EspoCRM, an open source customer relationship management (CRM) application. The flaw affects all versions prior to 9.3.9. An unauthenticated remote attacker can send an email to a monitored group address, IMAP mailbox, or email-to-Case address and embed arbitrary HTML in the plain-text body. EspoCRM stores that body and renders it without escaping inside Email Received stream notification emails sent to users following the related record. The issue is tracked as [CWE-79] (Cross-Site Scripting) and is resolved in EspoCRM 9.3.9.

Critical Impact
Unauthenticated attackers can inject HTML, and in mail clients that execute it, JavaScript into notification emails delivered to internal EspoCRM users.

Affected Products

EspoCRM versions prior to 9.3.9
Deployments using monitored group email accounts or IMAP inboxes
Deployments exposing an email-to-Case intake address

Discovery Timeline

2026-10-15 - CVE-2026-59994 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-59994

Vulnerability Analysis

The vulnerability resides in the stream notification path for Email Received events. EspoCRM accepts inbound email through monitored group inboxes, IMAP accounts, and email-to-Case addresses. When a user follows a related record, the system generates an outbound notification summarizing the incoming email. That summary includes the message body copied from the attacker-controlled email.

Prior fixes added sanitization to Post and Mention notification flows but did not cover the Email Received notification. As a result, HTML tags embedded in the plain-text body of the inbound email are rendered as live markup in the outbound notification. Mail clients that execute script tags will run attacker-controlled JavaScript in the recipient's context.

Root Cause

The root cause is missing output encoding in the notification builder. The pre-patch code passed the raw post content through nl2br(), which converts newlines to <br> tags but performs no HTML escaping. Attacker-supplied markup therefore flowed directly into the rendered email template.

Attack Vector

Exploitation requires no authentication. An attacker sends a crafted email to any monitored EspoCRM intake address with HTML payloads inside the plain-text body. Each user following the resulting record receives a notification email containing the injected markup. User interaction is limited to opening the notification in a mail client that renders HTML or executes JavaScript.

php

// Patch excerpt from application/Espo/Tools/EmailNotification/Processor.php
            $data['subject'] = $noteData->emailName;
        }

-        $data['post'] = nl2br($note->get('post'));
+        $data['post'] = Markdown::transform($note->getPost() ?? '');

        if (!$parentId || !$parentType) {
            return;

Source: GitHub Commit f9fd476. The fix routes the post content through the Markdown::transform() helper, which produces sanitized HTML output instead of concatenating raw body text.

Detection Methods for CVE-2026-59994

Indicators of Compromise

Inbound emails to monitored group inboxes or email-to-Case addresses containing <script>, <iframe>, <img onerror=>, or other active HTML in the plain-text body.
EspoCRM-generated notification emails whose rendered body contains unexpected markup, external image beacons, or inline event handlers.
Outbound requests from user mail clients to attacker-controlled domains shortly after a notification email is opened.

Detection Strategies

Inspect EspoCRM database records for Note entries of type Email Received where the stored post field contains HTML tag patterns.
Deploy mail gateway rules that flag messages targeting known EspoCRM intake addresses when the plain-text body contains script or event-handler syntax.
Correlate inbound email metadata with subsequent outbound notification volume to identify a single attacker email fanning out to many internal recipients.

Monitoring Recommendations

Enable logging on the EspoCRM IMAP and group email ingestion workers and retain raw message sources for forensic review.
Monitor web proxy and DNS telemetry for user clicks to unfamiliar domains originating from EspoCRM-branded notification messages.
Track EspoCRM application version across all instances and alert when any host runs a build earlier than 9.3.9.

How to Mitigate CVE-2026-59994

Immediate Actions Required

Upgrade EspoCRM to version 9.3.9 or later on all production and staging instances.
Audit monitored group email accounts, IMAP inboxes, and email-to-Case addresses for suspicious inbound messages received before the upgrade.
Notify EspoCRM users to treat notification emails with caution and avoid enabling remote content from untrusted senders.

Patch Information

The fix ships in EspoCRM release 9.3.9. Technical details are documented in GitHub Security Advisory GHSA-3rh4-9hcq-g79m. The code change in commit f9fd476 replaces the unescaped nl2br() call in application/Espo/Tools/EmailNotification/Processor.php with Markdown::transform().

Workarounds

Temporarily disable Email Received stream notifications until the upgrade to 9.3.9 is deployed.
Restrict monitored group email addresses and email-to-Case intake to authenticated internal senders using mail gateway allow-lists.
Configure recipient mail clients to render notifications as plain text, blocking script execution and remote content.

bash

# Verify installed EspoCRM version and upgrade
php -r "echo file_get_contents('/var/www/espocrm/application/Espo/Resources/defaults/version.json');"

# Apply upgrade via EspoCRM CLI
php command.php upgrade