PT-2026-94112 · Npm · Nodemailer
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Nodemailer versions prior to 9.1.1
Description
The software fails to honor the
disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using the legacy three-argument signature resolveContent(data, key, callback). This occurs because shared.resolveContent() normalizes the missing options argument to an empty object, causing the resolveContentValue() function to skip access-control checks and reach nmfetch(url) or fs.createReadStream(path). Consequently, application or plugin code resolving untrusted content (such as html, text, attachment path, or href) can be manipulated to read arbitrary local files or perform server-side request forgery (SSRF), which is when an attacker induces a server to make requests to an unintended location, bypassing the enabled sandbox.Recommendations
Update to version 9.1.1.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nodemailer