CVE-2017-5592: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacke...

Security readout for executives and security teams

CVE-2017-5592 lets a remote party make vulnerable Profanity XMPP clients display messages as if they came from another user, including trusted contacts. The direct issue is identity spoofing in the chat interface, which can support social engineering. The source bundle does not show code execution, data theft, or confirmed active exploitation. Exposure is likely limited to organizations or users running Profanity XMPP client versions 0.4.7 through 0.5.0 with Message Carbons support enabled or used. The bundle lists this CVE specifically for Profanity, while noting similar implementation problems affected multiple XMPP clients. Treat this as a targeted trust and social-engineering risk, not a broad infrastructure compromise. It deserves timely remediation where XMPP is used for sensitive approvals, operations, or incident response, but the bundle does not support emergency prioritization from active exploitation evidence. Mitigation focus: Inventory Profanity XMPP client versions in managed endpoints and user-supported environments.; Prioritize replacement or update of Profanity 0.4.7 through 0.5.0.; Check Profanity upstream guidance for the release containing the referenced fix commit..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.