GHSA-85x2-q946-cp5h
MediumSummary
The addressparser library ends angle-addr parsing at the first `>` it encounters, even when that character appears inside a quoted local part, a comment, or a domain literal. The domain is then read from the text preceding that `>`, resulting in incorrect email address interpretation.
Risk Assessment
An attacker can craft an email address that the application misinterprets, potentially bypassing address validation or spoofing another sender.
Recommendation
Update addressparser to a patched version or replace it with an RFC 5322-compliant parser. Verify that the application does not rely on incorrectly parsed addresses.
Other vulnerabilities in addressparser
See all- GHSA-v53p-9fqp-m79jHigh
When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.
- GHSA-m943-m63m-w62wMedium
addressparser ends an RFC 5322 group at the first `;`, even when it appears inside a quoted display name or a comment. The text after it is re-parsed as top-level recipients with quoting flipped, so text that a conformant parser reads as a display name or comment is misinterpreted.
- GHSA-8c8m-p3m8-cjg8Medium
RFC 5322 comments can be nested, but addressparser ends a comment at the first `)`, including the one closing a nested comment, and parses the remainder of the outer comment as header text. This leads to incorrect email address interpretation.
Original NVD description (English source)
### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `<"[email protected]>"@good.com>` is the mailbox `"[email protected]>"@good.com` under RFC 5322,
Vulnerability data from NVD (NIST) · CISA KEV · EPSS