CVE-2026-3455
CVE-2026-3455
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.
CVSS 5.1 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
mailparser
- Versiones
- ≥ 0, < 3.9.3: Afectada (semver)
Actualiza a 3.9.3
mailparser npm
- Intervalos de versiones afectados
- SEMVER: < 3.9.3
Actualiza a 3.9.3
Fuentes originales
- https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032
- https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08
- https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a
- https://github.com/nodemailer/mailparser/issues/412
- https://nvd.nist.gov/vuln/detail/CVE-2026-3455