Vaultwarden HTML injection vulnerability
Date: 2025-01
Affected: rust/vaultwarden
Attack vector: rce
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2024-55224
CWE: CWE-79

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.


Mitigations:

Architectural layers (MAESTRO):