AIKIDO-2026-577126
mail-parser is vulnerable to Improper Verification of Data Authenticity
75
High Risk
This Affects:
mail-parserTL;DR
The get_server_ipaddress() helper attributes a sender IP by scanning Received headers and selecting addresses by textual pattern rather than by position within the trust chain. Because a bracketed address written by the sender is byte-identical to one written by a relay, crafted Received or HELO content makes the function return an address the sender chose instead of the genuine relay IP. Downstream logic that uses the result for attribution, reputation, or blocklisting is misled while the documented trust boundary appears intact. The fix selects candidates positionally, treats the first from token and comment-group HELO markers as sender text, and merges IPv4 and IPv6 matches by position.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on get_server_ipaddress() for sender IP attribution.
Background info
mail-parser is vulnerable to Improper Verification of Data Authenticity in versions 0.0.1 - 4.6.1.
How to fix this
Upgrade the mail-parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant