AIKIDO-2026-310596
react-email is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
react-emailTL;DR
The Markdown component renders Markdown to HTML by interpolating link href/title and image title values directly into HTML attribute strings. Double quotes in those values were not escaped, so a value containing a " character could close the attribute early and inject additional attributes into the generated <a> or <img> tag. When an application renders attacker-controlled Markdown and the resulting HTML is displayed in a browser context, this attribute break-out can lead to HTML attribute injection and cross-site scripting. The fix escapes double quotes (" becomes ") in href and title before interpolation, matching the escaping already applied to image src/alt.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render user-supplied or otherwise untrusted Markdown through the Markdown component.
Background info
react-email is vulnerable to Cross-Site Scripting (XSS) in versions 6.0.0 - 6.6.6.
How to fix this
Upgrade the react-email library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant