Medium severity6.1NVD Advisory· Published Mar 3, 2026· Updated Apr 29, 2026
CVE-2026-3455
CVE-2026-3455
Description
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mailparsernpm | < 3.9.3 | 3.9.3 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08nvdPatchWEB
- gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585anvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-7gmj-h9xc-mcxcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-3455ghsaADVISORY
- security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032nvdThird Party AdvisoryWEB
- github.com/nodemailer/mailparser/issues/412nvdIssue TrackingWEB
News mentions
0No linked articles in our index yet.