CVE-2026-3455

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting XSS via the textToHtml function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded...

@8base/api-cli (>=0.0.1, <=0.1.0), @abhishekdeb/ezmailer (>=0.0.1, <=0.0.2) +573 more potentially affected by CVE-2026-3455 via mailparser (>=0.2.30, <=3.9.1)

mailparser NPM version =0.2.30, =0.0.1, =0.0.1, =0.6.0, =0.0.1, =0.0.1, =1.2.1, =0.16.9, =1.0.0, =2.5.0-beta.0, =1.3.5, =1.3.10 - @autohive/cell-gmail 0.8.1 - @autohive/cell-imap 0.2.11 and more Source cves: CVE-2026-3455 Source advisory: MEND:CVE-2026-3455...

CVE-2026-3455

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting XSS via the textToHtml function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded...

mailparser security vulnerability

MailParser is an email parser developed by Nodemailer as open source software. Versions of MailParser prior to 3.9.3 contained a security vulnerability. This vulnerability stemmed from the textToHtml function’s improper handling of URLs in email content, which could lead to cross-site scripting...

CVE-2026-3455: Improper Neutralization of Input During Web Page Generation

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting XSS via the textToHtml function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded...

PT-2026-22720

Name of the Vulnerable Software and Affected Versions mailparser versions prior to 3.9.3 Description The package mailparser is susceptible to Cross-site Scripting XSS due to insufficient sanitization of URLs within email content. Specifically, the textToHtml function does not properly handle URLs...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +74 more potentially affected by CVE-2026-3455 via mailparser (>=3.0.0, <=3.9.1)

mailparser NPM version =3.0.0, =0.6.0, =0.0.1, =0.0.1, =1.0.0, =1.0.64-alpha, =1.0.21-alpha, =4.0.1-alpha, =1.0.0, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2026-3455 Source advisory: SNYK:JS-MAILPARSER-15204032...

Cross-site Scripting (XSS)

Overview mailparser is an email parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the textToHtml function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to t...