VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 2, 2026· Updated Jan 2, 2026

listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

CVE-2026-21483

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/knadh/listmonkGo
>= 1.1.1, < 6.0.06.0.0
github.com/knadh/listmonkGo
< 1.1.1-0.20251231125615-74dc5a01cfbb1.1.1-0.20251231125615-74dc5a01cfbb

Affected products

1
  • Knadh/ListmonkOSV
    Range: v0.1.0-alpha, v0.1.1-alpha, v0.1.2-alpha, …

Patches

1
74dc5a01cfbb

Add sandboxing to campaign preview iframe.

https://github.com/knadh/listmonkKailash NadhDec 31, 2025via ghsa
commit
1 file changed · +14 −8
  • frontend/src/components/CampaignPreview.vue+14 −8 modified
    @@ -18,7 +18,7 @@
           </form>
 
           <iframe id="iframe" name="iframe" ref="iframe" :title="title" :src="isPost ? 'about:blank' : previewURL"
-            @load="onLoaded" />
+            @load="onLoaded" sandbox="allow-scripts" />
         </section>
         <footer class="modal-card-foot has-text-right">
           <b-button @click="close">
@@ -61,6 +61,7 @@ export default {
     return {
       isVisible: true,
       isLoading: true,
+      formSubmitted: false,
     };
   },
 
@@ -71,11 +72,15 @@ export default {
     },
 
     // On iframe load, kill the spinner.
-    onLoaded(l) {
-      if (l.srcElement.contentWindow.location.href === 'about:blank') {
+    onLoaded() {
+      if (!this.isPost) {
+        this.isLoading = false;
         return;
       }
-      this.isLoading = false;
+
+      if (this.formSubmitted) {
+        this.isLoading = false;
+      }
     },
   },
 
@@ -98,11 +103,12 @@ export default {
   },
 
   mounted() {
-    setTimeout(() => {
-      if (this.isPost) {
+    if (this.isPost) {
+      setTimeout(() => {
         this.$refs.form.submit();
-      }
-    }, 100);
+        this.formSubmitted = true;
+      }, 100);
+    }
   },
 };
 </script>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.