AIKIDO-2026-10941

TL;DR

Nodemailer’s disableFileAccess and disableUrlAccess protections can be bypassed when using jsonTransport. Although the normal MIME streaming path enforces these options, jsonTransport calls mail.normalize(), which resolves message fields through shared.resolveContent() without checking those restrictions. As a result, attacker-controlled fields such as attachment paths or text.href may still trigger local file reads or outbound HTTP requests, exposing file contents in JSON output or causing unintended network access.