Because \S includes < and >, a string beginning like an email address could make the auto-link replacement consume an opening HTML tag while leaving the remainder to be interpreted as markup. This minimal form illustrates the primitive:

The upstream fix restricts the query suffix so it cannot contain angle brackets or whitespace:

The vendor describes the issue as "zero-click" because no link click is required. Opening or previewing the email while authenticated is still the mail-client action that renders the payload.

Affected and fixed versions

The public fix commits are:

• 1.7 line: 5477e979aae0317e111564bfc9971ba7707cc165
• 1.6 line: 4c278f4868c67b163567cae3d74e58d872913459

Upgrade to Roundcube 1.6.17 / 1.7.2 or a newer supported release.

Preconditions and scope

• The attacker needs a way to deliver email to the victim, but no Roundcube account, password, plugin access, or administrator access.
• The message must be rendered by an affected Roundcube version as text/plain.
• The victim must have an authenticated Roundcube session and open or preview the message.
• No third-party Roundcube plugin is required.
• The positive Docker test used Roundcube's default Elastic skin. The root primitive is in server-side plain-text conversion; other skins were not claimed as independently tested here.
• Roundcube's "remote resources have been blocked" control did not stop the tested primitive: the hidden image uses a failing relative src to invoke onerror. A collector callback still requires browser network reachability.
• Roundcube's session cookie is normally HttpOnly. This PoC does not attempt to read it. Its same-origin request automatically uses the authenticated session, and the separate-message subject is the impact proof.

The demonstrated result is authenticated JavaScript execution and read access to one earlier email subject. Account takeover, arbitrary message-body theft, and server-side code execution are not claimed by this repository.

PoC behavior

cve-2026-54433-poc.py is self-contained and uses only the Python standard library. It:

1. builds a crafted ordinary RFC 5322 text/plain email;
2. scans at most 50 lower UIDs in the current Roundcube mailbox by default;
3. selects the first older subject not beginning with CVE-2026-54433;
4. POSTs subject, origin, and task to /capture/<random-marker>;
5. never reads cookies, credentials, message bodies, or attachments;
6. optionally submits the email using plain SMTP, STARTTLS, or implicit TLS;
7. optionally polls Webhook.site or a compatible JSON status endpoint.

The payload inserts the DOM comment:

It also hides the auto-linked address fragment and broken-image indicator while showing the caller-supplied benign body.

Offline generation

Generate the email without making a network connection:

This writes:

• cve-2026-54433-trigger.eml
• cve-2026-54433-evidence.json

Inspect the generated message before using the sending mode.

Authorized SMTP test with Webhook.site

The --collector value can be a Webhook.site UUID, capture URL, or #!/view/ URL. The script derives the capture and polling endpoints.

If SMTP_PASSWORD is absent, the script asks for the password without echoing or storing it. A differently named variable can be selected with --smtp-password-env NAME. Avoid --smtp-password on multi-user systems because command-line arguments may be visible in process listings or shell history.

The script asks for an explicit YES before sending. In non-interactive, already-authorized lab automation, pass --yes. It waits up to 24 hours for a callback by default; use --timeout SECONDS to change this.

For a non-Webhook.site collector, pass the capture base and optional JSON status endpoint:

The included collector.py implements the compatible /capture/<marker> and /status endpoints. It binds to loopback by default. Real HTTPS deployment and access control are intentionally left to the authorized tester.

Reproducible Docker lab

The lab has no published host ports and contains only synthetic messages. It uses the same Python PoC to generate the trigger, delivers both messages into a disposable Dovecot mailbox, signs in through a disposable headless browser, and records whether the injected handler read the previous subject.

Requirements: Docker, Python 3, OpenSSL, and jq.

Vulnerable test:

Fixed control:

For a video or live browser demonstration, run:

It publishes Roundcube and the visual collector on loopback only. Open the two URLs printed by the script, show the initially empty collector, sign in using the printed synthetic credentials, click the trigger email, and return to the collector. The captured synthetic subject appears in an auto-refreshing table. Ctrl-C removes the disposable containers and network.

To record the browser interaction and a real Webhook.site callback, use the reproducible recorder. It requires Chrome, Xvfb, ffmpeg, Docker, and an authorized Webhook.site token supplied through the environment:

The resulting MP4 shows the visible Roundcube trigger row, an annotated mouse click, and Webhook.site displaying the received synthetic subject. The token is never stored in the source tree.

Recorded artifact: assets/CVE-2026-54433-webhook-demo.mp4

The recording includes a visible terminal panel showing the generate-only Python invocation, its payload-generation output, the Roundcube click, and the resulting Webhook.site request.

The visual demo also accepts COLLECTOR_URL and COLLECTOR_VIEW_URL; point both at an authorized Webhook.site token to show the real collector receiving the synthetic subject. Do not reuse a token containing unrelated requests.

Reproduced results

The end-to-end comparison was run on 2026-08-14 on x86-64 Linux with Docker:

Positive callback body (synthetic value, origin sanitized):

The structured, sanitized comparison is in docs/e2e-results.json.

Verify the publication tree

The offline check compiles the Python sources, generates a fresh .eml, and checks its MIME type, payload primitive, visible body, comment, and metadata:

Set RUN_DOCKER=1 to append both end-to-end Docker controls:

Public exploit search snapshot

On 2026-08-14, targeted searches for CVE-2026-54433 on GitHub, Exploit-Database, and Packet Storm did not locate a validated, configurable mail-sending exploit with an end-to-end vulnerable/fixed comparison. Vendor and vulnerability-database entries, scanner-template discussions, and descriptive write-ups already existed. This is a dated search snapshot, not a claim that no other PoC can exist.

References

• Roundcube security release announcement
• NVD entry for CVE-2026-54433
• Roundcube 1.7 fix commit
• Roundcube 1.6 fix commit

Vulnerability discovery: Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR), as credited by Roundcube.

Research, impact validation, and exploit implementation: A. Ramos <[email protected]> (Twitter: @aramosf).

About

CVE-2026-54433 Roundcube plain-text email stored XSS PoC with bounded authenticated mailbox-subject evidence and a vulnerable/fixed Docker lab.