Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/mailparser@3.9.3
purl pkg:npm/mailparser@3.9.3
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-t8gs-kwkq-m3b5 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code. CVE-2026-3455
GHSA-7gmj-h9xc-mcxc

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T15:51:04.931108+00:00 GitLab Importer Fixing VCID-t8gs-kwkq-m3b5 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/mailparser/CVE-2026-3455.yml 38.6.0
2026-06-12T07:49:20.111994+00:00 GithubOSV Importer Fixing VCID-t8gs-kwkq-m3b5 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-7gmj-h9xc-mcxc/GHSA-7gmj-h9xc-mcxc.json 38.6.0
2026-06-11T20:38:26.127935+00:00 GHSA Importer Fixing VCID-t8gs-kwkq-m3b5 https://github.com/advisories/GHSA-7gmj-h9xc-mcxc 38.6.0