A rich text editor for editing and building email templates
88%
Total Score
healthy
Frequent releases and broad contributor activity support a dependable package despite type and workflow hygiene gaps.
The package declares 32 runtime dependencies, including many editor and Tiptap components; this is substantial coupling for a library, though it fits the rich editor functionality described by the package.
The project uses TypeScript, Vitest, Turbo, Rollup, and Vite, providing a structured build and test toolchain; no security scanning tool was detected, which is a minor gap.
The indicator reports no type declarations for a React and TypeScript-oriented library, which can make integration less safe and ergonomic for consumers.
All 11 workflows were analyzed and all 24 action references are pinned, but the audit found a high-confidence template-injection issue and an informational trusted-publishing finding; one workflow also has top-level write permissions.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-180874 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @react-email/editor is vulnerable to Prototype Pollution in versions 1.0.0 - 1.4.7. | 1.0.0 - 1.4.7 | Medium |
AIKIDO-2026-54895 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @react-email/editor is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 - 1.5.1. | 1.0.0 - 1.5.1 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
prismjs Version ^1.30.0 | — | — |
@tiptap/pm Version ^3.17.1 | — | — |
react-email Version 6.11.1 | — | — |
@tiptap/core Version ^3.17.1 | — | — |
@tiptap/html Version ^3.17.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.