rainloop -- cross-site-scripting (XSS) vulnerability

Simon Scannell reports:

    The code vulnerability can be easily exploited by an
    attacker by sending a malicious email to a victim that
    uses RainLoop as a mail client. When the email is viewed
    by the victim, the attacker gains full control over the
    session of the victim and can steal any of their emails,
    including those that contain highly sensitive information
    such as passwords, documents, and password reset links.