ByteOS Network

CVE Vulnerability Details :

CVE-2026-3455

PUBLISHED

More Info Official Page

Assigner-snyk

Assigner Org ID-bae035ff-b466-4ff4-94d0-fc9efd9e1730

Published At-03 Mar, 2026 | 05:00

Updated At-03 Mar, 2026 | 05:00

▼CVE Numbering Authority (CNA)

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Affected Products

Vendor

n/a

Product

mailparser

Versions

Affected

From 0 before 3.9.3 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	Cross-site Scripting (XSS)

Type: N/A

CWE ID: N/A

Description: Cross-site Scripting (XSS)

Metrics

Version	Base score	Base severity	Vector
3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P
4.0	5.1	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P

Version: 4.0

Base score: 5.1

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P

Credits

Ravishanker Kusuma

References

Hyperlink	Resource
https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032	N/A
https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08	N/A
https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a	N/A
https://github.com/nodemailer/mailparser/issues/412	N/A