AIKIDO-2026-737795

TL;DR

Statamic's default (automagic) form notification email renders user-submitted form values without escaping them. An unauthenticated visitor who submits a public frontend form can inject HTML into the notification email delivered to the configured recipients. Before the fix these submitted values were placed into the email body unescaped, producing stored cross-site scripting against the recipients who open the email. The fix escapes submitted values when building the automagic notification email.