{"action":"Upgrade mailparser to 3.9.3 or later.","affected":[{"fixed":"3.9.3","introduced":"0"}],"component":"mailparser","cve_ids":["CVE-2026-3455"],"ecosystem":"npm","epss":0.00323,"exploited":false,"fixed_versions":["3.9.3"],"ghsa_id":"GHSA-7gmj-h9xc-mcxc","id":"tcs_01M5KFA0AW54QBN35WPTNPEYFN","modified_at":"2026-03-04T20:41:19.751032Z","published_at":"2026-03-03T06:31:14Z","references":["https://osv.dev/vulnerability/GHSA-7gmj-h9xc-mcxc","https://nvd.nist.gov/vuln/detail/CVE-2026-3455","https://github.com/nodemailer/mailparser/issues/412","https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08","https://gist.github.com/hayageek/7fcb225e3b1ea9a341d560403fbb585a","https://github.com/nodemailer/mailparser","https://security.snyk.io/vuln/SNYK-JS-MAILPARSER-15204032"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-7gmj-h9xc-mcxc","url":"https://osv.dev/vulnerability/GHSA-7gmj-h9xc-mcxc"}],"summary":"mailparser vulnerable to Cross-site Scripting"}