CVE-2019-10741

K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states "We don't plan to take any action because of this."

• CWE-254

• https://github.com/k9mail/k-9/issues/3925Third Party Advisory
• https://github.com/k9mail/k-9/issues/3925Third Party Advisory

Published

Apr 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1073An information disclosure vulnerability exists when the Wind…
• CVE-2019-10732In KDE KMail 5.2.3, an attacker in possession of S/MIME or P…4.3
• CVE-2019-10734In KDE Trojita 0.7, an attacker in possession of S/MIME or P…
• CVE-2019-10735In Claws Mail 3.14.1, an attacker in possession of S/MIME or…
• CVE-2019-1074An elevation of privilege vulnerability exists in Microsoft …
• CVE-2019-10740In Roundcube Webmail before 1.3.10, an attacker in possessio…4.3
• CVE-2019-10742Axios up to and including 0.18.0 allows attackers to cause a…
• CVE-2019-10743All versions of archiver allow attacker to perform a Zip Sli…5.5
• CVE-2019-10744Versions of lodash lower than 4.17.12 are vulnerable to Prot…9.1
• CVE-2019-10745assign-deep is vulnerable to Prototype Pollution in versions…7.5
• CVE-2019-10746mixin-deep is vulnerable to Prototype Pollution in versions …9.8
• CVE-2019-10747set-value is vulnerable to Prototype Pollution in versions l…9.8