{"id":"CVE-2026-113442","kind":"vulnerability","aliases":["CVE-2026-113442"],"related":[],"title":"HTML email summary includes unescaped visitor input, allowing HTML injection","description":"Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.","summary":"Values typed by visitors were inserted into the HTML summary email without escaping. An unauthenticated attacker can inject HTML that renders in the email shown to the recipient.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","other","web-forms"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:52+00:00","updated_at":"2026-10-25T04:24:52+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:24:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HTML email summary includes unescaped visitor input, allowing HTML injection","impact":"low","summary":"Values typed by visitors were inserted into the HTML summary email without escaping. An unauthenticated attacker can inject HTML that renders in the email shown to the recipient.","category":"other","nicknames":[],"who_cares":["email","web-forms"],"confidence":0.4,"needs_auth":"no","worst_case":"Attacker injects HTML into an email shown to the recipient","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113442; the sources name no product.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00049,"input_tokens":3261,"output_tokens":328,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113442':13A,16A '-2026':12A,15A 'allow':8A 'attack':37B,66C 'could':67C 'cve':11A,14A 'email':2A,17B,32B,45B,60C,75C 'enter':51C 'escap':34B,63C 'form':21B 'html':1A,9A,30B,40B,58C,72C 'includ':4A 'inject':10A,39B,71C 'input':7A 'insert':27B 'place':55C 'recipi':49B,81C 'render':42B 'shown':46B,78C 'summari':3A,31B,59C 'type':23B 'unauthent':36B,65C 'unescap':5A 'use':68C 'valu':22B,50C 'visitor':6A,25B,53C 'web':20B 'web-form':19B 'without':33B,61C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113442","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}