AIKIDO-2026-959173
nodemailer is vulnerable to Improper Access Control
59
Medium Risk
This Affects:
nodemailerTL;DR
MailMessage.resolveContent called with its documented legacy signature omits the options argument and never forwards the disableFileAccess and disableUrlAccess sandbox flags to the underlying resolver. Untrusted message content processed through that path can then read local files via a path value or reach internal URLs via an href value. The default sendMail flow stays protected, so the bypass affects plugins or applications that call the legacy API on attacker-influenced data. The fix threads the message access policy through resolveContent so the sandbox flags are always applied.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a plugin or your application calls resolveContent with the legacy signature on untrusted message content.
Background info
nodemailer is vulnerable to Improper Access Control in versions 0.0.1 - 9.1.0.
How to fix this
Upgrade the nodemailer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.