Is CVE-2026-33657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33657 being exploited in the wild.

How severe is CVE-2026-33657?

Medium severity, with a CVSS score of 4.6, published 13 April 2026.

Is there a fix for CVE-2026-33657?

A patch was published on 2026-03-24: Version 9.3.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33657 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33657?

Check whether you run Espocrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33657: EspoCRM stored HTML injection in email notifications

CVE-2026-33657 · Severity: medium · CVSS 4.6 · Published 2026-04-13

EspoCRM, an open-source customer relationship management platform, is vulnerable to a security flaw that allows standard users to inject malicious HTML into system-generated emails. By posting a specially crafted note or mention, an attacker can cause the system to send emails containing deceptive content, such as fake login forms or tracking pixels, to other users. Because these emails originate from the official system address, they appear legitimate, significantly increasing the risk of successful phishing attacks and unauthorized user tracking within the organization.

Technologies: Espocrm. Vendors: Espocrm.

Quick answers

Is CVE-2026-33657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33657 being exploited in the wild.
How severe is CVE-2026-33657?: Medium severity, with a CVSS score of 4.6, published 13 April 2026.
Which products and versions are affected?: EspoCRM EspoCRM <= 9.3.3.
Is there a fix for CVE-2026-33657?: A patch was published on 2026-03-24: Version 9.3.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33657 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33657?: Check whether you run Espocrm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored HTML injection vulnerability exists in EspoCRM's notification system due to improper output encoding in server-side Handlebars templates. Specifically, the 'post' field in stream activity notes is rendered using unescaped triple-brace syntax ({{{post}}}). Furthermore, the Markdown processor (Michelf\Markdown) preserves inline HTML by default, and the rendering pipeline explicitly bypasses sanitization for fields within the 'additionalData' array. An authenticated attacker with standard privileges can exploit this by submitting a note via the API containing malicious HTML. When the system generates email notifications for mentions or posts, the raw HTML is included in the email body. This enables phishing, UI manipulation, and user tracking via image beacons, all delivered via the trusted system SMTP identity. The issue is resolved in version 9.3.4.

Affected products

EspoCRM EspoCRM <= 9.3.3

Timeline

2026-03-24: patched: Version 9.3.4 released
2026-04-13: disclosed: Security advisory published
2026-04-13: advisory: CVE-2026-33657 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.