GitHub Advisoryadvisory · npm

GHSA-7gmj-h9xc-mcxc mailparser vulnerable to Cross-site Scripting

LOW Published 2026-03-03 Modified 2026-03-04 Official page ↗
Aliases
CVE-2026-3455
Ecosystem
npm
Packages
mailparser
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-03-04

Affected packages

• npm mailparser: < 3.9.3 → fixed in 3.9.3

Description

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Related

Alias · CVE (1)

  • CVE-2026-3455 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References