EspoCRM allows the plain‑text body of an incoming email to contain arbitrary HTML. Prior to version 9.3.9 this body is later embedded directly into stream notification emails without escaping, creating a stored HTML injection (CWE‑79). An unauthenticated remote actor can craft an email to a monitored group or IMAP address, inject malicious HTML or JavaScript, and that code will be delivered to users in notification mails that sandboxed mail clients might execute. The impact is the potential compromise of user sessions and confidentiality when the client renders the injected content.

The vulnerability affects EspoCRM installations running any version older than 9.3.9. The fix was introduced in release 9.3.9 and later versions; earlier releases are susceptible.

The CVSS base score is 4.3, reflecting moderate severity. EPSS is <1%, indicating a very low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. An attacker needs only to send a specially crafted email to a monitored group or IMAP address that EspoCRM watches; no authentication or privilege escalation is required. The risk is confined to environments where recipients use mail clients that execute embedded HTML/JavaScript, as only then does the injected code run.