Cross-site Scripting Vulnerability in Mailparser by Nodemailer

CVE-2026-3455

What is CVE-2026-3455?

The Mailparser package prior to version 3.9.3 is susceptible to Cross-site Scripting (XSS) due to inadequate sanitization of URLs in email content. An attacker can exploit this vulnerability by injecting malicious JavaScript code into crafted URLs. When these URLs are processed by the textToHtml() function, arbitrary scripts may execute in the browsers of users who open the affected emails, leading to potential data theft and other malicious actions. It's crucial for users of this package to upgrade to the latest version to mitigate this risk.

References