Roland Tapken discovered that insufficient input sanitising in KMail’s
plain text viewer allowed the injection of HTML code.