---
id: "CVE-2026-113442"
kind: "vulnerability"
aliases: ["CVE-2026-113442"]
title: "HTML email summary includes unescaped visitor input, allowing HTML injection"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["email", "other", "web-forms"]
not_affected_if: []
published_at: "2026-10-20T10:17:05+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113442", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# HTML email summary includes unescaped visitor input, allowing HTML injection

Values typed by visitors were inserted into the HTML summary email without escaping. An unauthenticated attacker can inject HTML that renders in the email shown to the recipient.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113442

## From the sources

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_