CVE-2026-3455

CVE-2026-3455 is a Cross-site Scripting (XSS) vulnerability found in mailparser versions prior to 3.9.3, specifically within the textToHtml() function. This flaw allows an attacker to inject malicious JavaScript into a victim's browser by manipulating URLs in email content with improper sanitization. Rated as Medium severity (CVSS 6.1), it requires user interaction (UI:R) but can be exploited remotely (AV:N) with low attack complexity (AC:L), potentially leading to limited confidentiality and integrity impacts (C:L, I:L). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, though it has received some media coverage.