{"id":"UBUNTU-CVE-2021-26925","details":"Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.","modified":"2025-07-16T07:42:26.014466Z","published":"2021-02-09T09:15:00Z","upstream":["CVE-2021-26925"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26925"},{"type":"REPORT","url":"https://roundcube.net/news/2021/02/08/security-update-1.4.11"},{"type":"REPORT","url":"https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-26925"}],"affected":[{"package":{"name":"roundcube","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/roundcube@1.5.0+dfsg.1-2?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2"}]}],"versions":["1.4.11+dfsg.1-4"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"roundcube","binary_version":"1.5.0+dfsg.1-2"},{"binary_name":"roundcube-core","binary_version":"1.5.0+dfsg.1-2"},{"binary_name":"roundcube-mysql","binary_version":"1.5.0+dfsg.1-2"},{"binary_name":"roundcube-pgsql","binary_version":"1.5.0+dfsg.1-2"},{"binary_name":"roundcube-plugins","binary_version":"1.5.0+dfsg.1-2"},{"binary_name":"roundcube-sqlite3","binary_version":"1.5.0+dfsg.1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-26925.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}