Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2 2007-12-09 and earlier versions when using Internet Explorer allows remote attackers to inject arbitrary web script or HTML via style sheets containing expression commands.