CVE-2021-46144: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Roundcube Roundcube: before 1.4.13 (fixed in 1.4.13); from 1.5.0, before 1.5.2 (fixed in 1.5.2)

Published 2022-01-06. Last modified 2026-06-17.