Junglewise Threat Intelligence

Tuta Mail DOM attribute and CSS injection in Contact Viewer

Severity: medium · CVSS 4 · Published 2025-12-19

Vendors: npm.

Executive brief

Tuta Mail is a secure email service that allows users to manage contacts. When a user imports contacts from untrusted sources, crafted contact data can be used to inject malicious DOM attributes and CSS into the contact viewer interface. An attacker can override link addresses and manipulate button appearance to trick users into visiting malicious URLs through clickable overlays, though actual JavaScript execution is prevented by security controls.

Technical details

The vulnerability exists in the ContactViewer component where untrusted contact field data (social IDs, website URLs, messenger handles, phone numbers, and addresses) is directly interpolated into Mithril hyperscript selectors without sanitization. An attacker can craft contact data with payloads like `][href=https://attacker.com][style=position:fixed;width:150vw;height:200vh` which break out of the intended attribute context and inject arbitrary DOM attributes and CSS. The attack vector is importing malicious VCF files or receiving crafted contact data. While CSP prevents JavaScript execution, CSS can be leveraged to create overlay buttons covering the screen that redirect to arbitrary URLs when clicked. The vulnerability affects all versions prior to 314.251111.0, which contains the fix. No active exploitation in the wild has been reported.

Affected products

  • Tutao Tuta Mail prior to 314.251111.0

Timeline

  • 2025-12-19: disclosed
  • 2025-12-19: patched: Fixed in version 314.251111.0

References