hMailServer versions 6.0.0 through 6.3.3 allow a remote, unauthenticated attacker to inject and execute arbitrary JScript in the service process. The vulnerability is triggered when the server processes a password containing a backslash followed by an apostrophe, which is not properly sanitized, allowing the injected script to terminate a string literal and be parsed as code. Depending on server configuration, the attacker can create or instantiate COM objects, including WScript.Shell, enabling execution of arbitrary commands under the service account. This can lead to full compromise of the email server.

The affected product is Progressive Robot Ltd's hMailServer running on Windows. Vulnerable builds are 6.0.0 through 6.3.3 when event scripting is enabled, the script language is set to JScript, and at least one of the OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed handlers is defined. VBScript event scripts and Linux builds are not affected.

The CVSS score of 9.8 classifies the flaw as critical. Current exploitation requires a non-default configuration: event scripting enabled, JScript chosen as language, and relevant handlers defined. Though EPSS is not reported, no known exploits are registered in KEV, but the high severity and network exposure via standard mail protocols (SMTP AUTH, POP3, IMAP) indicate a significant risk for unattended or improperly configured servers. Attackers could use standard login or protocol interactions to trigger the injection without authentication, making this vulnerability particularly dangerous for exposed mail services.