CVE-2026-92595

A flaw was found in Nodemailer. Plugin or application code that resolves untrusted message content through the MailMessage.resolveContent API using its legacy three-argument signature can bypass intended sandbox restrictions. This vulnerability allows an attacker to read arbitrary local files or...

CVE-2026-92595: External Control of File Name or Path

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

PT-2026-94112

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.1 Description The software fails to honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the legacy...