CVE-2026-33657

EspoCRM versions 9.3.3 and below contain a stored HTML injection vulnerability in stream activity notes that allows authenticated standard users to inject arbitrary HTML into system-generated email notifications. The vulnerability stems from improper handling of the post field through unescaped Handlebars templates, default HTML preservation in Markdown processing, and missing sanitization in the rendering pipeline. This flaw enables attackers to craft malicious content that persists in the system and renders directly into emails without escaping. The vulnerability has a CVSS score of 5.4 (Medium severity) with a network attack vector, low complexity, and requirement for low privileges and user interaction. While confidentiality and integrity impacts are limited, the threat is magnified by the fact that injected content appears to originate from trusted system addresses, enabling targeted phishing attacks, user tracking via embedded resources, and email UI manipulation. The @mention feature allows attackers to direct malicious emails to specific users, increasing campaign effectiveness. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities list. The EPSS score of 0.0003 indicates minimal probability of exploitation, and community attention remains low. However, organizations running EspoCRM 9.3.3 or earlier should upgrade to version 9.3.4 immediately to remediate this stored injection risk, particularly if the system handles sensitive communications or user authentication.