Back Linuxsecurity

Fedora 44 python-postorius Critical Cross-Site Scripting CVE-2026

Linuxsecurity •LinuxSecurity Advisories • June 27, 2026

Update to 1.3.13 (minor packaging changes); backport unreleased fix for cross- side scripting via unescaped HTML

* Wed Jun 17 2026 Michel Lind - 1.3.13-1 - Backport unreleased fix for CVE-2026-44742 - With 1.3.13 we no longer need to exclude example_project * Tue Jun 16 2026 Python Maint - 1.3.12-8 - Rebuilt for Python 3.15

[ 1 ] Bug #2476457 - CVE-2026-44742 python-postorius: Postorius: Cross-Site Scripting via unescaped HTML in message subject [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ef34f94241' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 44 Address Critical XSS Vulnerability in Python-Postorius Fedora has released updates for the python-postorius package to address a critical cross-site scripting (XSS) vulnerability identified as CVE-2026-44742. This vulnerability allows attackers to exploit unescaped HTML in message subjects, potentially affecting users of the Fedora operating system. The updates, version 1.3.13, were backported to mitigate this issue and are available for installation via the 'dnf' package manager. Users are urged to upgrade to the latest version to protect against potential exploitation. The vulnerability was published on May 7, 2026, and affects all versions prior to the fix. The updates were confirmed by Fedora's release engineering team and the Python maintainers. 2 sources 71

Extracted Entities

Fedora 44 python-postorius Critical Cross-Site Scripting CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)