PT-2025-47000 · Unknown+1 · Email Parsing Library+1

Published 2025-10-07 · Updated 2026-05-11 · CVE-2025-13033

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Email Parsing Library (affected versions not specified)

Description A flaw exists in the email parsing library related to how recipient email addresses are processed. Specifically, the library improperly handles specially formatted addresses, allowing an attacker to redirect emails intended for internal recipients to an external address controlled by the attacker. This is achieved by crafting a recipient address that includes an external address within quotes. Successful exploitation could result in a data leak of sensitive information and bypass security measures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-1286

CWE-436

Related Identifiers

CVE-2025-13033

GHSA-JJ37-3377-M6VV

GHSA-MM7P-FCC7-PG87

Affected Products

Debian

Email Parsing Library

References · 22

• https://cve.org/CVERecord?id=CVE-2025-13033 · Security Note
• https://access.redhat.com/errata/RHSA-2026:3751 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-13033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13033 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13033 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mm7p-fcc7-pg87 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13033 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj37-3377-m6vv · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13033 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:15979 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-13033 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-13033 · Vendor Advisory
• https://github.com/nodemailer/nodemailer · Note
• https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626 · Note
• https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87 · Note