Roundcube has released a bug fix version of their 0.7.x line. Contains an XSS fix. I haven't tried, but upstream's been pretty easy on their changes, so a rename of the current 0.7.x ebuild is probably all that's needed. Reproducible: Always
Added to CVS.