CVE-2026-21483
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.
How to fix
- nadh listmonk6.0.0 or later
- github.com/knadh/listmonk6.0.0, 1.1.1-0.20251231125615-74dc5a01cfbb or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nadh listmonk | v < 6.0.0 | 6.0.0 |
| github.com/knadh/listmonkGo | 1.1.1 ≤ v < 6.0.0, v < 1.1.1-0.20251231125615-74dc5a01cfbb | 6.0.0, 1.1.1-0.20251231125615-74dc5a01cfbb |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.