---
id: CVE-2003-0038
aliases:
  - GHSA-82rm-28q9-435p
  - PYSEC-2026-657
title: 'Mailman Cross-site scripting (XSS) vulnerability '
summary: 'Mailman Cross-site scripting (XSS) vulnerability '
severity: medium
vendor: mailman
product: mailman
ecosystem: pip
affected:
  - mailman < 2.1.1
patched:
  - mailman 2.1.1
published: '2022-04-29'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-82rm-28q9-435p'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2003-0038'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/11152'
  - url: 'http://marc.info/?l=bugtraq&m=104342745916111'
  - url: 'http://telia.dl.sourceforge.net/sourceforge/mailman/xss-2.1.0-patch.txt'
  - url: 'http://www.debian.org/security/2004/dsa-436'
  - url: 'http://www.osvdb.org/9205'
  - url: 'http://www.securityfocus.com/bid/6677'
  - url: 'http://www.securitytracker.com/id?1005987'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.0476
epssPercentile: 0.91487
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:47.272Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-23T07:13:21.124Z'
---

## Overview

Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.

## Affected packages

- `mailman < 2.1.1`

## Remediation

Upgrade to a patched release:

- `mailman 2.1.1`