XSS in Nodemailer Mailparser
CVE-2026-3455
Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (23.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Nodemailer Mailparser
- N/a Mailparser — versions 0
Weakness classification (CWE)
References
- report@snyk.io (Third Party Advisory)
- report@snyk.io (Patch)
- report@snyk.io (Exploit, Third Party Advisory)
- report@snyk.io (Issue Tracking)
Frequently asked questions
- What is CVE-2026-3455?
- CVE-2026-3455 is a medium-severity vulnerability in Nodemailer Mailparser, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-03-03.
- How severe is CVE-2026-3455?
- Medium severity. CVSS v3 base score is 6.1 out of 10.