EUVD-2026-68437
GHSA-h3hj-cmcx-xc66
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low privilege required (authenticated application user); high confidentiality impact from arbitrary file read, low integrity impact from SSRF; no scope change as subsequent systems receive data rather than being compromised.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 67 npm packages depend on nodemailer (31 direct, 38 indirect)
Ecosystem-wide dependent count for version 9.0.1.
DescriptionCVE.org
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.
AnalysisAI
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level raw option. The disableFileAccess and disableUrlAccess flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a MimeNode is constructed for a raw message in lib/mail-composer/index.js:34-35, leaving the raw path completely unrestricted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target application uses nodemailer version 9.0.0 or earlier; (2) the application has set `disableFileAccess: true` or `disableUrlAccess: true` on the nodemailer transport or message options to sandbox untrusted input; (3) an attacker-controlled value can reach the message-level `raw` option - specifically an object with a `path` property (for file read) or an `href` property (for SSRF); and (4) the attacker has authenticated access to trigger the email-sending code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) signals a network-accessible, low-complexity, low-privilege flaw with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 9.0.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nodemailer
View allThis affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch c
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the t
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message nor
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comme
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today