[GH-ISSUE #423] Potential attack using "mailto:" #351

New issue

Closed

opened 2026-02-25 21:34:49 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 21:34:49 +03:00

Owner

Originally created by @dumblob on GitHub (Aug 24, 2020).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/423

Originally assigned to: @jasonmunro on GitHub.

I'm not sure Cypht does anything special with "mailto:" links, but either way it might be interesting to see what threats are lurking around:

https://www.zdnet.com/article/some-email-clients-are-vulnerable-to-attacks-via-mailto-links/

Originally created by @dumblob on GitHub (Aug 24, 2020). Original GitHub issue: https://github.com/cypht-org/cypht/issues/423 Originally assigned to: @jasonmunro on GitHub. I'm not sure Cypht does anything special with "mailto:" links, but either way it might be interesting to see what threats are lurking around: https://www.zdnet.com/article/some-email-clients-are-vulnerable-to-attacks-via-mailto-links/

kerem

2026-02-25 21:34:49 +03:00

closed this issue
added the
Security

research
labels

kerem commented

2026-02-25 21:34:49 +03:00

Author

Owner

@jasonmunro commented on GitHub (Sep 17, 2020):

Cypht supports mailto links to pre-populate the To, Cc, Bcc, Subject, and Body fields. This specific vulnerability uses the more esoteric attachment parameter to pre-attach a local file which we don't support so we should be good here.

@jasonmunro commented on GitHub (Sep 17, 2020): Cypht supports mailto links to pre-populate the To, Cc, Bcc, Subject, and Body fields. This specific vulnerability uses the more esoteric attachment parameter to pre-attach a local file which we don't support so we should be good here.