Vulnerability · Published Jun 21, 2025 · Assigned by GitHub_M

CVE-2025-52557Mail-0 Zero Session Hijacking Via Email

High 8.6

In plain English

A high-severity security flaw in Zero from Mail-0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 63.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81.

Affected products (as reported)

Vendor	Product	Versions
Mail-0	Zero	= 0.8

Weakness: CWE-1384 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85 x_refsource_CONFIRM
https://github.com/Mail-0/Zero/pull/1386 x_refsource_MISC
https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f x_refsource_MISC