AIKIDO-2026-310596

react-email is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) Pre-CVE Published Jul 23, 2026

Medium Risk

This Affects:

react-email

6.0.0 - 6.6.6

Fixed in 6.6.7

Are you affected? Scan for Free

TL;DR

The Markdown component renders Markdown to HTML by interpolating link href/title and image title values directly into HTML attribute strings. Double quotes in those values were not escaped, so a value containing a " character could close the attribute early and inject additional attributes into the generated <a> or <img> tag. When an application renders attacker-controlled Markdown and the resulting HTML is displayed in a browser context, this attribute break-out can lead to HTML attribute injection and cross-site scripting. The fix escapes double quotes (" becomes ") in href and title before interpolation, matching the escaping already applied to image src/alt.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you render user-supplied or otherwise untrusted Markdown through the Markdown component.