VulnSocial

CVE-2026-3455Disclosure(nodemailer / mailparser)

LOWCVSS 2.0 · LOW

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

nodemailer CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mailparser

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • 4 total mentions across 1 day

Affected systems

Vendors
nodemailer
Products
mailparser

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-03-03: 4Technical Details · 2026-03-03: 403-03
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-3455 Cross-Site Scripting in Mailparser Before 3.9.3 via textToHtml() Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3455

    Post summary

    The text announces CVE-2026-3455, a Cross‑Site Scripting flaw in Mailparser before version 3.9.3 via the textToHtml() function, without mentioning PoC, exploit code, or patch details.

    0001060
    4.0K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3455 - Mailparser Cross-site Scripting (XSS) Vulnerability Intel Report: https://ift.tt/VUWQ28q

    Post summary

    The alert announces CVE-2026-3455, a Mailparser XSS vulnerability, and provides a link to an Intel report, but offers no PoC, exploit code, or patch details.

    0000042
    342 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-3455 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in t… https://www.cve.org/CVERecord?id=CVE-2026-3455 ----- Traducción: Versiones del paq… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-3455, a cross‑site scripting vulnerability in mailparser before 3.9.3 caused by improper URL sanitisation in the textToHtml() function, without providing PoC, exploit, or patch details.

    0000037
    55 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-3455 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in t… https://www.cve.org/CVERecord?id=CVE-2026-3455

    Post summary

    The text announces that mailparser versions before 3.9.3 are vulnerable to XSS via textToHtml() due to improper URL sanitisation, with no mention of PoC, exploit, or patch.

    00000340
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnodemailermailparser-node.js-

Explore more

Back to dashboardnodemailer CVEsmailparser vulnerabilities