EUVD-2026-87904
GHSA-v6j4-p35g-mq6p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote and unauthenticated (AV:N/PR:N), but AC:H because three stacked non-default configuration prerequisites must be present; RCE as service account yields C:H/I:H/A:H.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
6DescriptionCVE.org
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a password containing a backslash followed by an apostrophe, sent in any logon (SMTP AUTH, POP3, IMAP) that names an existing, active account. Exploitation requires a non-default configuration: event scripting enabled (off by default), the script language set to JScript (the default is VBScript), and an OnClientValidatePassword handler defined in the event script. The server wrote event values into the handler call as JScript string literals, escaping the apostrophe but not the backslash, so such a value closes the literal and the rest of it is parsed as script. The same flaw is reachable by a remote POP3 server through the message UID it returns, where an OnExternalAccountDownload handler is defined, and by a remote SMTP server through the error reply it rejects a delivery with, where an OnDeliveryFailed handler is defined. Before 6.2.25 the injected script can create any COM object, and from 6.2.25 it can with the default ScriptAllowedObjects value of '*'; WScript.Shell among them gives command execution as the service account. VBScript event scripts and the Linux builds of Progressive Robot Ltd's hMailServer are not affected.
Articles & Coverage 1
AnalysisAI
Arbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticated, remote attacker run attacker-controlled code inside the hMailServer service process with the service account's privileges by sending a password containing a backslash immediately followed by an apostrophe in any SMTP AUTH, POP3, or IMAP logon that names an existing active account. The flaw is only reachable in a non-default configuration - event scripting enabled (off by default), the script language set to JScript (default is the unaffected VBScript), and a relevant handler (OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed) defined - and equivalent paths exist through a malicious remote POP3 server's message UID or a malicious remote SMTP server's rejection reply. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific non-default hMailServer configuration on Windows: (1) event scripting must be enabled (disabled by default); (2) the script language must be set to JScript (the default is VBScript, which is NOT vulnerable); and (3) at least one relevant handler must be defined - OnClientValidatePassword (reachable via SMTP AUTH/POP3/IMAP logon naming an existing active account), OnExternalAccountDownload (reachable via a malicious remote POP3 server's message UID), or OnDeliveryFailed (reachable via a malicious remote SMTP server's rejection reply). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) presents this as a trivially exploitable pre-auth RCE, but that score materially overstates real-world risk because it does not model the non-default configuration the description explicitly requires. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hMailServer v6.3.4, the vendor-released patch (https://gitlab.com/Progressiverobot/hmailserver/-/releases/v6.3.4; fix commit 5a3de9001d6c5e833662ada8e44ce10d42d76b1a). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every hMailServer instance and confirm whether any run versions 6.0.0 through 6.3.3, then identify which of those have event scripting enabled (off by default), the script language set to JScript (the default VBScript is unaffected), and any of the handlers OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed defined; for any instance meeting all three conditions, immediately disable event scripting or switch the script language to VBScript, remove or neutralize the affected handlers, and restrict SMTP AUTH, POP3, and IMAP listener exposure to trusted networks or VPN only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-95 – Eval Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today