EspoCRM CVE-2026-59994

Requires an EspoCRM instance (prior to 9.3.9) configured to ingest inbound mail via a monitored group email account, IMAP address, or an email-to-Case address - that inbound-mail feature is the exact prerequisite that makes the injection reachable by an unauthenticated sender. A triggering user must also be following the related record so the 'Email Received' stream notification is generated and emailed to them. Exploitation is LIMITED by: required victim interaction (the follower must open the notification email, per UI:R); HTML injection always renders, but JavaScript execution occurs only in mail clients that execute embedded script (many strip/sandbox it); and only instances using inbound email monitoring are exposed at all.

This is a genuine but moderate-severity stored HTML/JS injection (CWE-79), and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields 4.3 (Medium): injection is reachable by an unauthenticated remote attacker (PR:N) simply by emailing a monitored address, but actual impact requires a following user to open the resulting 'Email Received' notification (UI:R), and impact is limited to integrity (I:L) with no confidentiality or availability effect. Publicly available exploit code exists (vendor GitHub Security Advisory GHSA-3rh4-9hcq-g79m plus the fix commit), which raises practical reproducibility, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC signal and the absence-of-active-exploitation signal are distinct and should not be conflated. Net: a legitimate patch-priority item for EspoCRM operators (low-complexity, unauthenticated injection vector) but not a drop-everything emergency, since real harm depends on a mail client that executes embedded JavaScript, and many modern clients strip or sandbox it. EPSS and KEV data were not supplied in the input and should be checked before final prioritization.

An attacker with no account sends a crafted email to an EspoCRM-monitored group inbox, IMAP mailbox, or email-to-Case address, embedding malicious HTML (and optionally a <script> payload) in the plain-text body. EspoCRM stores the body and, when generating the 'Email Received' stream notification, renders it unescaped; a staff user following the related record opens the notification email and the HTML renders - executing the injected JavaScript in mail clients that permit it. A working exploit path is publicly documented in the vendor's GitHub Security Advisory and the corresponding fix commit.