CVE-2026-3455 MEDIUM

CVE-2026-3455

Vendor N/A

Product mailparser

Weakness CWE-79 · XSS

Published March 3, 2026

Last update March 3, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P

What the vulnerability does

01Description

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.

Key dates

02Disclosure timeline

March 3, 2026 CVE published

March 3, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3455 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-50439 WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability CVE-2026-34812 Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting CVE-2024-51808 WordPress codeSnips plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-45609 GLPI has a Reflected XSS in /front/stat.graph.php CVE-2025-20310 Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability