Nodemailer versions prior to 9.1.1 ignore the sandbox directives that block file and URL access when message content is resolved through the legacy three‑argument form of MailMessage.resolveContent. The internal implementation substitutes an empty options object, so the per‑message flags disableFileAccess and disableUrlAccess are lost. As a result, code that resolves untrusted content can invoke the file system or perform outbound HTTP(S) calls, allowing local file disclosure and server‑side request forgery. This flaw does not affect the internal paths used by transporter.sendMail, but it enables an attacker who controls the plugin or message content to access arbitrary files or reach internal network resources.

The vulnerability affects the Node.js NPM package nodemailer, product nodemailer, in all released versions up to and including 9.1.0. The fix was introduced in version 9.1.1 and later releases contain the enforcement of sandbox options.

The CVSS score of 6 indicates a moderate severity, with no exploitation probability reported and an EPSS score below 1%. The vulnerability is not listed in the CISA KEV catalog. Exploitation can occur when an application or plugin calls resolveContent using the legacy signature on content that may include untrusted html, text, attachment paths or URLs. Because the bypass removes access controls, an attacker with the ability to choose content can read local files or cause the server to fetch arbitrary URLs, potentially leaking sensitive data or facilitating further network attacks. The attack vector is local to the Node.js process and does not require external network interaction for the initial exploit.