Not associated with Roundcube but didn't see posts about this yet.
On August 4, the Roundcube project released versions 1.6.8 and 1.5.8 (LTS) of
their webmail client with fixes for several XSS vulnerabilities in HTML e-mail
display. From the announcement page at
<https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8>:
Fix XSS vulnerability in post-processing of sanitized HTML content
[CVE-2024-42009]
Fix XSS vulnerability in serving of attachments other than HTML or SVG
[CVE-2024-42008]
Fix information leak (access to remote content) via insufficient CSS
filtering [CVE-2024-42010]
Links to both releases are on the abovementioned page.
-Valtteri
