mailparser vulnerable to Cross-site Scripting

Description

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote “ to the URL with embedded malicious JavaScript code.

Recommendation

Update the mailparser package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.9.3
• Patched version(s): 3.9.3

References

• GHSA-7gmj-h9xc-mcxc
• security.snyk.io
• CVE-2026-3455
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599
• QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting - CVE-2026-0824
• Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler - CVE-2026-1721
• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mailparser