6.1Orta
CVE-2026-3455
Açıklama
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.
Zayıflık türü (CWE):
CWE-79
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nodemailer | mailparser | < 3.9.3 | |
| — | mailparser | < 3.9.3 |
Kaynaklar ve yamalar
- https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032 Third Party Advisory
- https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08 Patch
- https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a ExploitThird Party Advisory
- https://github.com/nodemailer/mailparser/issues/412 Issue Tracking
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:nodemailer:mailparser:*:*:*:*:*:node.js:*:*< 3.9.3