Executive brief
mailparser is a Node.js library that parses email messages and extracts content for display in web applications. A Cross-site Scripting (XSS) vulnerability in its textToHtml() function allows attackers to inject malicious JavaScript code via specially crafted URLs in email content. When vulnerable versions process an email containing such URLs, the injected scripts execute in the browsers of users viewing the email, potentially stealing credentials, session tokens, or performing actions on their behalf.
Technical details
The vulnerability is a Stored/Reflected XSS (CWE-79) in the textToHtml() function of mailparser before version 3.9.3. The root cause is improper URL sanitization—the function fails to properly escape or validate URLs extracted from plain-text email content before converting them to HTML anchor tags. An attacker can bypass validation by embedding extra quote characters (") in a URL along with malicious JavaScript event handlers (e.g., onmouseover). Since mailparser does not validate or sanitize the URL attribute value, the injected event handler becomes executable HTML. The attack requires only that a victim opens/renders an email containing the malicious content in a system using a vulnerable version; no authentication or special user interaction beyond email viewing is needed. The vulnerability was patched in version 3.9.3.
Affected products
- nodemailer mailparser < 3.9.3
Timeline
- 2026-01-28: disclosed: Issue #412 opened on GitHub
- 2026-03-03: patched: Version 3.9.3 released with fix
- 2026-03-03: advisory: GHSA-7gmj-h9xc-mcxc published