CVE-2026-3455

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3455
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a Exploit Third Party Advisory
https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08 Patch
https://github.com/nodemailer/mailparser/issues/412 Issue Tracking
https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nodemailer:mailparser:*:*:*:*:*:node.js:*:*
History

13 Mar 2026, 17:53

Type Values Removed Values Added
References () https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a - () https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a - Exploit, Third Party Advisory
References () https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08 - () https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08 - Patch
References () https://github.com/nodemailer/mailparser/issues/412 - () https://github.com/nodemailer/mailparser/issues/412 - Issue Tracking
References () https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032 - () https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032 - Third Party Advisory
Summary
  • (es) Las versiones del paquete mailparser anteriores a la 3.9.3 son vulnerables a cross-site scripting (XSS) a través de la función textToHtml() debido a la sanitización incorrecta de las URL en el contenido del correo electrónico. Un atacante puede ejecutar scripts arbitrarios en los navegadores de las víctimas al añadir una comilla extra ' a la URL con código JavaScript malicioso incrustado.
CPE cpe:2.3:a:nodemailer:mailparser:*:*:*:*:*:node.js:*:*
First Time Nodemailer
Nodemailer mailparser

03 Mar 2026, 05:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-03 05:17

Updated : 2026-03-13 17:53

NVD link : CVE-2026-3455

Mitre link : CVE-2026-3455

CVE.ORG link : CVE-2026-3455

JSON object : View

Products Affected

nodemailer

  • mailparser
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')