CVE-2026-3455
CVE-2026-3455
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.
CVSS 5.1 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
mailparser
- Versions
- ≥ 0, < 3.9.3: Affected (semver)
Update to 3.9.3
mailparser npm
- Affected ranges
- SEMVER: < 3.9.3
Update to 3.9.3
Original sources
- https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032
- https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08
- https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a
- https://github.com/nodemailer/mailparser/issues/412
- https://nvd.nist.gov/vuln/detail/CVE-2026-3455