OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-38375.json"