A flaw in the filterXSS function of Intermesh Group‑Office’s email viewer lets an attacker embed malicious tags, such as svg with onload handlers, in an email body. When the victim opens the email, the raw content is rendered by MessagePanel.js, executing the script inside the victim’s session. This can lead to arbitrary JavaScript execution, credential theft, and the ability to perform additional malicious actions from the victim’s browser context.

Intermesh Group‑Office versions before 6.8.181, before 25.0.116, and before 26.0.58 are vulnerable. These include the 6.x, 25.x, and 26.x major releases. No other product versions are listed as affected.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available and the issue is not in the CISA KEV catalog, suggesting limited yet non‑negligible exploitation potential. Attackers can craft a malicious email and send it to a legitimate user; the victim must open the message to trigger the exploit. The vulnerability is local to the victim’s browser and does not allow direct server‑side code execution.