Please refer to https://listmonk.app/docs/security-reports/ first to see the list of non-issues and acceptable-risks before reporting a vulnerability.
Security: knadh/listmonk
Security
SECURITY.md
-
Stored XSS Leading to Admin Account TakeoverGHSA-jmr4-p576-v565 published
Jan 2, 2026 by knadhHigh -
CSRF to XSS to Admin TakeoverGHSA-rf24-wg77-gq7w published
Sep 9, 2025 by knadhCritical -
`env` Sprig template function allows reading environment variables on the host on campaign templates.GHSA-jc7g-x28f-3v3h published
Jun 8, 2025 by knadhCritical
Learn more about advisories related to knadh/listmonk in the GitHub Advisory Database