EspoCRM, an open-source CRM platform, contains a stored HTML injection flaw affecting versions 9.3.3 and earlier. The vulnerability allows any authenticated non‑administrative user to embed arbitrary HTML into the Post field of stream activity notes. Because server‑side Handlebars templates render this field with triple‑brace syntax and the Markdown processor preserves inline HTML, the injected markup is saved and later inserted unescaped into system‑generated email notifications. Recipients view these emails through the system’s SMTP identity, which appears trusted, enabling phishing, tracking via embedded resources such as image beacons, and manipulation of the email user interface.

The affected product is EspoCRM version 9.3.3 and earlier, released by the EspoCRM team. The issue is fixed in version 9.3.4, so any deployment running an earlier release is vulnerable. Users should verify the installed version and plan to upgrade if necessary.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication and the creation of a stream note, so only users with permissions to add notes can abuse it. Once the attacker crafts a malicious post, the content is stored and rendered into outbound emails, which can be targeted to specific recipients via the @mention feature, amplifying the attack’s impact.