CVE-2026-3455: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3455 is a Cross-Site Scripting (XSS) vulnerability in the mailparser npm package (by Nodemailer) affecting all versions before 3.9.3. The flaw exists in the textToHtml() function, which fails to properly sanitize URLs found in email content, allowing attackers to inject malicious JavaScript into rendered email HTML. It was disclosed on January 28, 2026, by researcher Ravishanker Kusuma (hayageek), and published publicly on March 2–3, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 2.0 (Low) (Snyk Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in lib/mail-parser.js at line 1132, where the textToHtml() function inserts link.url and link.text values — extracted from email bodies via linkify-it — directly into HTML <a href="..."> tags without encoding. An attacker crafts a plain-text email containing a URL with an embedded double-quote character (e.g., http://example.com?"onmouseover="alert('XSS')"), which breaks out of the href attribute context and injects arbitrary HTML event handlers. The fix in commit 921a67d escapes double quotes in URLs using " and HTML-encodes link text using the he library (GitHub Commit, PoC Gist).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the rendered email HTML output generated by the vulnerable textToHtml() function. The primary risks are session token theft, credential harvesting, and unauthorized actions performed in the context of the victim's session. Confidentiality and integrity are both impacted at a low-to-moderate level; availability is not affected. The scope is changed (CVSS), meaning the injected script can affect resources beyond the vulnerable component itself (Snyk Advisory, ENISA EUVD).

A public proof-of-concept exploit was published by the discoverer (hayageek) on January 28, 2026, in the form of a malicious .eml file and accompanying Node.js test script (PoC Gist). The CVSS v4.0 exploit maturity is rated "Proof of Concept." No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.035% (18th percentile), indicating low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Snyk Advisory).

1. Craft malicious email: Create a plain-text email (.eml) with a URL in the body that contains an embedded double-quote and JavaScript event handler, e.g.:

   From: attacker@evil.com
   To: victim@example.com
   Subject: Check this out
   Content-Type: text/plain
   
   Visit: http://google.com?"onmouseover="alert('XSS')"

2. Deliver the email: Send the crafted email to a target whose email application uses the mailparser npm package (versions < 3.9.3) to parse and render emails.
3. Trigger textToHtml() processing: The vulnerable application calls simpleParser() or MailParser with skipTextToHtml: false, causing textToHtml() to process the plain-text body and convert URLs to HTML anchor tags.
4. Observe injected HTML: The generated HTML output contains an unescaped anchor tag such as <a href="http://google.com?" onmouseover="alert('XSS')">, where the double-quote breaks out of the href attribute and injects the event handler.
5. Execute payload: When the victim's browser renders the output HTML and the user interacts with the link (e.g., mouseover), the injected JavaScript executes, enabling session hijacking, credential theft, or further attacks (PoC Gist, GitHub Issue).

• Network: Outbound requests from a victim's browser to unexpected third-party domains shortly after rendering an email (potential data exfiltration via XSS).
• Logs: Application logs showing mailparser processing emails with URLs containing unencoded double-quote characters (") in query strings or paths.
• File System: Presence of generated HTML files (e.g., poc_output.html) containing onmouseover, onclick, or other event handler attributes injected into <a href> tags.
• Email Content: Inbound emails with plain-text bodies containing URLs of the pattern http://...?"<event_handler>="<payload>" targeting textToHtml() processing (PoC Gist).

Upgrade the mailparser npm package to version 3.9.3 or higher, which escapes double quotes in URLs and HTML-encodes link text in the textToHtml() function (GitHub Commit, Snyk Advisory). As a temporary workaround, applications can set skipTextToHtml: true in simpleParser() options to disable the vulnerable HTML conversion, though this will suppress plain-text-to-HTML rendering. Additionally, implementing a Content Security Policy (CSP) on the rendering application can limit the impact of any injected scripts.

The vulnerability was reported via a GitHub issue (#412) by researcher hayageek on January 28, 2026, and was promptly addressed by the Nodemailer maintainer (andris9) in commit 921a67d (GitHub Issue, GitHub Commit). Snyk published an advisory and credited the researcher, and the vulnerability was registered in the ENISA European Vulnerability Database as EUVD-2026-9279 (ENISA EUVD). Social media activity was limited, with automated CVE notification accounts on Bluesky and Nitter noting the disclosure shortly after publication.