~ / search / GHSA-7gmj-h9xc-mcxc

GHSA-7gmj-h9xc-mcxc

mailparser vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Low CVE-2026-3455

Packages

EcosystemPackageAffectedFixed in
npm mailparser < 3.9.3 3.9.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

References

External links from the advisory. They lead to third-party sites.