Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
1.3
CVE-2024-55224: Vaultwarden Email Username Injection Risk
CVE-2024-55224 · published 1 year ago
Summary
Untrusted input in Vaultwarden's email feature can lead to unauthorized code execution. This affects Vaultwarden versions prior to 1.32.5. We recommend updating to the latest version to prevent potential security risks.
What to do
- Update dani-garcia vaultwarden to version 1.32.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | dani-garcia | vaultwarden |
< 1.32.5 Fix: upgrade to 1.32.5
|
| – | dani-garcia | vaultwarden |
< 1.32.5 cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:* |
Original advisory text
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
References
- https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in...
- https://github.com/advisories/GHSA-g5x8-v2ch-gj2g
- https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4 URL
- https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 URL
- https://nvd.nist.gov/vuln/detail/CVE-2024-55224 Vendor Advisory
- https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55224... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Jan 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta