Executive brief
HSC MailInspector, an enterprise email security gateway used to protect organizations from phishing and malware, contains a vulnerability that allows attackers to execute malicious scripts in a user's web browser. By tricking a user into clicking a specially crafted link, an attacker could steal login sessions, hijack user accounts, or display fraudulent content. This could lead to unauthorized access to the email security management interface and potential exposure of sensitive corporate communications.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in HSC MailInspector v5.3.3-7 within the '/mailinspector/tap/tap.php' endpoint. The root cause is the improper neutralization of user-controlled input, specifically failing to account for alternate or obfuscated JavaScript syntax (CWE-87). An unauthenticated remote attacker can exploit this by crafting a URL containing malicious scripts that are reflected back to the victim without adequate output encoding. Successful exploitation requires a victim to visit the malicious link, enabling the attacker to execute arbitrary JavaScript, steal session tokens, or perform actions on behalf of the user. While the NVD entry lists the severity as 'info' pending assessment, the researcher's advisory specifies a CVSS v3.1 score of 8.2.
Affected products
- HSC Labs MailInspector 5.3.3-7
Timeline
- 2026-05-18: disclosed: Vulnerability disclosed by researcher Sql3t0
- 2026-05-18: advisory: CVE-2026-29964 published