A cross‑site scripting flaw exists in the composeMail function of the Activities Module/Notes component in krayin's Laravel‑CRM. The flaw allows an attacker to inject malicious script content that is subsequently rendered in the mailbox UI, enabling remote script execution in the victim’s browser. This originates from insufficient sanitization of user input before display and falls under CWE‑79 and CWE‑94. Exploitation can compromise the confidentiality, integrity, and availability of the application by hijacking sessions, stealing credentials, defacing content, or executing arbitrary code on the client side. The vulnerability is present in all releases up to version 2.2.

The affected product is krayin’s Laravel‑CRM, version 2.2 and earlier. The issue resides in the test code located at packages/Webkul/Admin/tests/e2e‑pw/tests/mail/inbox.spec.ts within the Activities Module/Notes. A patch was released in commit 73ed28d466bf14787fdb86a120c656a4af270153, which removes the vulnerable processing of user input.

The CVSS score is 5.1, indicating moderate severity, but the vulnerability is remotely exploitable and public exploits are available. Since EPSS data is not provided and it is not listed in the CISA KEV catalog, the likelihood of exploitation depends largely on attacker interest and the presence of the vulnerable version. Attackers can deliver the malicious payload through any interface that allows composing mail in the application, making the vector network‑based and requiring only a user to view a crafted page. Prompt remediation is essential to prevent XSS attacks.