Lem

**Name of the Vulnerable Software and Affected Versions** Rspamd versions prior to 1.6.3 **Description** The issue concerns the interface/js/app/history.js file in WebUI, where the Subject and Message-Id headers are mishandled, allowing for XSS attacks on the history page. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the history page until the update is applied.