CVE-2026-3610: XSS in Mailinspector 5.3.2-3 to 5.4.0

Successful exploitation of CVE-2026-3610 enables an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to various malicious outcomes, including the theft of session cookies, redirection to phishing websites, and the modification of displayed content. The remote nature of the vulnerability means an attacker does not need local access to exploit it. Given the public availability of the exploit, the risk of immediate exploitation is elevated. The impact extends to any user interacting with Mailinspector within the affected version range.

1. Reserved2026-03-05
2. Published2026-03-06
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3610 is to upgrade Mailinspector to version 5.4.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and sanitization on the error_description parameter to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple script (e.g., <script>alert('XSS')</script>) through the affected parameter and verifying that the script does not execute.