npm/@tutao/tutanota-utils: low

Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature

Action: Upgrade @tutao/tutanota-utils to 314.251111.0 or later.

npm i @tutao/tutanota-utils@314.251111.0

Affected

Fixed versions

Sources

• osv: GHSA-24v3-254g-jv85
• https://github.com/tutao/tutanota/security/advisories/GHSA-24v3-254g-jv85
• https://github.com/tutao/tutanota/commit/e28345f5f78f628f9d5c04e785f79543f01dca8b
• https://github.com/tutao/tutanota
• https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L326
• https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L341
• https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L356
• https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L391
• https://github.com/tutao/tutanota/blob/452700a96d490646550ad2a02229973590291faf/src/mail-app/contacts/view/ContactViewer.ts#L415

published 2025-12-19T21:32:35Z · modified 2025-12-19T21:50:33.801300Z · JSON