MEDIUM6.1

GHSA-7gmj-h9xc-mcxc

mailparser vulnerable to Cross-site Scripting

Quick fix

GHSA-7gmj-h9xc-mcxc — mailparser: upgrade to the fixed version with the command below.

npm install mailparser@3.9.3

Details

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mailparser

Introduced in: 0Fixed in: 3.9.3

Fixnpm install mailparser@3.9.3

References

https://nvd.nist.gov/vuln/detail/CVE-2026-3455[ADVISORY]
https://github.com/nodemailer/mailparser/issues/412[WEB]
https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08[WEB]
https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a[WEB]
https://github.com/nodemailer/mailparser[PACKAGE]
https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032[WEB]