Detections
Analytics

SCA: security update for github.com/axllent/mailpit (GHSA-54wq-72mp-cq7c)

medium Tenable Cloud Security Plugin ID 436823

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is
 vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and
 `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by
 including carriage return characters (`\r`) in the email address. This header injection occurs because the
 regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character
 class. Version 1.28.3 fixes this issue. (CVE-2026-23829)

See Also

https://github.com/advisories/GHSA-54wq-72mp-cq7c

Plugin Details

Severity: Medium

ID: 436823

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/20/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-23829

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/20/2026

Vulnerability Publication Date: 1/18/2026

Reference Information

CVE: CVE-2026-23829