https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 18:27:40 +0000 https://db.gcve.eu/vuln/ghsa-85x2-q946-cp5h <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Vulnerability summary</p> <p>addressparser ends an angle-addr at the first `&gt;` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `&gt;`. `&lt;&#34;a@evil.com&gt;&#34;@good.com&gt;` is the mailbox `&#34;a@evil.com&gt;&#34;@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.</p> <p>### Attacker capabilities</p> <p>The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.</p> <p>### Realistic exploitation scenario</p> <p>An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `&lt;&#34;a@evil.com&gt;&#34;@good.com&gt;`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO:&lt;&#34;\&#34;a&#34;@evil.com&gt;` and the message, with whatever content the application puts into it, is delivered to the attacker&#39;s domain. The security boundary crossed is the application&#39;s recipient allow list. In the inbound direction, mailparser reports…</p> <p><strong>Affected:</strong> npm: nodemailer</p> <p>### Vulnerability summary</p> <p>addressparser ends an angle-addr at the first `&gt;` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `&gt;`. `&lt;&#34;a@evil.com&gt;&#34;@good.com&gt;` is the mailbox `&#34;a@evil.com&gt;&#34;@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.</p> <p>### Attacker capabilities</p> <p>The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.</p> <p>### Realistic exploitation scenario</p> <p>An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `&lt;&#34;a@evil.com&gt;&#34;@good.com&gt;`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO:&lt;&#34;\&#34;a&#34;@evil.com&gt;` and the message, with whatever content the application puts into it, is delivered to the attacker&#39;s domain. The security boundary crossed is the application&#39;s recipient allow list. In the inbound direction, mailparser reports…</p> https://db.gcve.eu/vuln/ghsa-85x2-q946-cp5h