A high-severity vulnerability in Nodemailer allows authenticated attackers to bypass security sandboxes, leading to unauthorized file access and server-side request forgery.

The application fails to apply disableFileAccess and disableUrlAccess flags to the message-level raw option, which allows an authenticated attacker to supply malicious path or href properties that the system processes without authorization checks.

This vulnerability poses a significant risk to data confidentiality, as attackers can read sensitive system files and exfiltrate them via outgoing emails. With a CVSS score of 7.1, the flaw is classified as High, reflecting the potential for unauthorized data access and the ability to leverage the server to perform internal network requests, which could lead to further exploitation within the internal infrastructure.

Immediate Action: Update the Nodemailer package to version 9.0.1 or later immediately to ensure the security flags are correctly applied.

Proactive Monitoring: Review application logs for unusual outgoing email traffic or suspicious patterns involving file paths or external URLs in raw email payloads.

Compensating Controls: Implement strict egress filtering on the host environment to prevent the server from reaching unintended internal or external resources via SSRF.

Public Exploit Available: exploit_available (false)

The vulnerability in Nodemailer presents a clear path for data exfiltration and internal network reconnaissance. Organizations utilizing this library should prioritize the update to version 9.0.1, as it is the only definitive way to enforce the required security constraints. Failure to remediate this issue leaves the application susceptible to unauthorized file access by any authenticated user.