CVE-2026-3455: XSS

Q: What is the severity of CVE-2026-3455?

CVE-2026-3455 is categorized as a medium severity vulnerability due to its potential for executing scripts in victim browsers.

Q: How do I fix CVE-2026-3455?

To fix CVE-2026-3455, update the mailparser package to version 3.9.3 or later.

Q: What impact does CVE-2026-3455 have on affected applications?

CVE-2026-3455 can lead to Cross-site Scripting (XSS) attacks, allowing attackers to execute arbitrary scripts in users' browsers.

Q: Which versions of mailparser are affected by CVE-2026-3455?

CVE-2026-3455 affects all versions of mailparser prior to 3.9.3.

Q: Is CVE-2026-3455 related to any specific functions in the mailparser package?

CVE-2026-3455 is related to the textToHtml() function which improperly sanitizes URLs in email content.

Published Mar 3, 2026

Updated

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Affected Software

2 affected components

npm/mailparser<3.9.3

Nodemailer Mailparser Node.js<3.9.3

Remediation

Patch Available

https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08

Event History

Mar 3, 2026

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 AM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 22, 58183

Event

via NVD·02:41 AM

Frequently Asked Questions

What is the severity of CVE-2026-3455?

CVE-2026-3455 is categorized as a medium severity vulnerability due to its potential for executing scripts in victim browsers.

How do I fix CVE-2026-3455?