Roundcube has released a bug fix version of their new 0.8.x line. Contains bug fixes and a fix for "a recently reported XSS vulnerability". http://sourceforge.net/news/?group_id=139281&id=309799 Just renaming the current 0.8.2 ebuild to 0.8.4 works for me.
Added to CVS.
Thanks for the quick turn around Tim!