CVE-2026-3455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3455
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3455.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3455
Aliases
Downstream
Published
2026-03-03T05:00:11.753Z
Modified
2026-07-15T01:49:13.066539120Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
[none]
Details

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3455.json",
    "cna_assigner": "snyk"
}
References

Affected packages

Git / github.com/nodemailer/mailparser

Affected ranges

Type
GIT
Repo
https://github.com/nodemailer/mailparser
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
05db2242027f365c3f2f1a033daa7f5d738d7194
Fixed
921a67df4cfb38f0b411037d7b26fbd4d5411b08
Database specific 
{
    "cpe": "cpe:2.3:a:nodemailer:mailparser:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.9.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

mailparser-v3.*
mailparser-v3.8.0
v0.*
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.10
v0.2.11
v0.2.12
v0.2.13
v0.2.14
v0.2.15
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.21
v0.2.22
v0.2.23
v0.2.24
v0.2.25
v0.2.26
v0.2.28
v0.2.29
v0.2.3
v0.2.30
v0.2.31
v0.2.32
v0.2.33
v0.2.4
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.4.0
v0.4.1
v0.4.2
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.8.0
v2.8.1
v3.*
v3.0.0
v3.0.1
v3.1.0
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.5.0
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.6.8
v3.6.9
v3.7.1
v3.7.2
v3.7.3
v3.7.5
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3455.json"