CVE-2025-13033CWE-1286

CVE-2025-13033

High · published November 15, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

⚡ An improperly parsed email address could leave sensitive information wide open! An attacker can craft a recipient address that not only confuses your system but also redirects emails to their own sneaky external inbox. 🔐 Think of it like sending a letter with a hidden address inside — the post office delivers your confidential mail to the wrong person because they didn’t check the address carefully. It’s a recipe for disaster! This misdirection could lead to sensitive company data making its way into the hands of an unauthorized individual, potentially bypassing all your security measures. Imagine confidential emails with customer information or internal memos landing in the wrong hands — the fallout could be absolutely devastating!

Put simply

Think of it like sending a letter with a hidden address inside — the post office delivers your confidential mail to the wrong person because they didn’t check the address carefully. It’s a recipe for disaster! CVE-2025-13033 occurs in an email parsing library where specially formatted recipient addresses can trick the application into sending emails elsewhere. This vulnerability can bypass normal filtering and access controls, sending sensitive data to an attacker's external address.

What to do

This misdirection could lead to sensitive company data making its way into the hands of an unauthorized individual, potentially bypassing all your security measures. Imagine confidential emails with customer information or internal memos landing in the wrong hands — the fallout could be absolutely devastating! To tackle this, update the email parsing library to the latest version as patches are being released to address this flaw. Additionally, implement stricter validation checks on recipient addresses to ensure they don't contain external addresses. It's crucial to perform a thorough audit of email handling processes to prevent this from happening again! You've got this! By following these steps, you'll strengthen your defenses and keep your information safe. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2025-11-15T01:15Z
References (7)
EPSS history
Timeline
  • 14 NOV 19:37Z
    Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
    cvelistv5