CyberRota Analysis
AI-GeneratedNodemailer versions prior to 9.0.1 are vulnerable due to improper handling of the disableFileAccess and disableUrlAccess flags, which allows authenticated attackers to read arbitrary files or execute server-side request forgery by manipulating message-level raw options. This can lead to sensitive data exposure or unauthorized access to internal resources, making it critical for developers and system administrators using Nodemailer to prioritize this vulnerability and apply the necessary updates.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.