{"id":"CVE-2018-13796","aliases":["GHSA-xqvg-xm9m-p2c4","PYSEC-2026-661"],"title":"Moderate severity vulnerability that affects mailman","summary":"Moderate severity vulnerability that affects mailman","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","vendor":"mailman","product":"mailman","ecosystem":"pip","affected":["mailman < 2.1.28"],"patched":["mailman 2.1.28"],"published":"2018-09-11","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xqvg-xm9m-p2c4","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13796"},{"url":"https://bugs.launchpad.net/mailman/+bug/1780874"},{"url":"https://github.com/advisories/GHSA-xqvg-xm9m-p2c4"},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00034.html"},{"url":"https://security.gentoo.org/glsa/201904-10"},{"url":"https://usn.ubuntu.com/4348-1"},{"url":"https://www.mail-archive.com/mailman-users@python.org/msg71003.html"}],"tags":["osv","pip"],"epss":0.02705,"epssPercentile":0.85245,"ingestedAt":"2026-07-08T18:25:54.653Z","slug":"CVE-2018-13796","body":"## Overview\n\nAn issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.\n\n## Affected packages\n\n- `mailman < 2.1.28`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mailman 2.1.28`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}