CVE-2026-27492

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27492", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T19:46:03.541Z", "datePublished": "2026-02-21T10:16:03.913Z", "dateUpdated": "2026-02-24T18:08:44.011Z"}, "containers": {"cna": {"title": "Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused", "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "lang": "en", "description": "CWE-488: Exposure of Data Element to Wrong Session", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp"}, {"name": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1", "tags": ["x_refsource_MISC"], "url": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1"}, {"name": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20", "tags": ["x_refsource_MISC"], "url": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20"}], "affected": [{"vendor": "lettermint", "product": "lettermint-node", "versions": [{"version": "< 1.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T10:16:03.913Z"}, "descriptions": [{"lang": "en", "value": "Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence \u2014 such as transactional flows like password resets or notifications \u2014 are affected. This issue has been fixed in version 1.5.1."}], "source": {"advisory": "GHSA-49pc-8936-wvfp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:08:16.795387Z", "id": "CVE-2026-27492", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:08:44.011Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27492", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:08:16.795387Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:08:36.104Z"}}], "cna": {"title": "Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused", "source": {"advisory": "GHSA-49pc-8936-wvfp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lettermint", "product": "lettermint-node", "versions": [{"status": "affected", "version": "< 1.5.1"}]}], "references": [{"url": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp", "name": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1", "name": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20", "name": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence \u2014 such as transactional flows like password resets or notifications \u2014 are affected. This issue has been fixed in version 1.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "CWE-488: Exposure of Data Element to Wrong Session"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T10:16:03.913Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27492", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:08:44.011Z", "dateReserved": "2026-02-19T19:46:03.541Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T10:16:03.913Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lettermint-node", "vendor": "lettermint", "versions": [{"status": "affected", "version": "< 1.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lettermint:lettermint:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "20B84381-74A5-4D57-91F0-5626B5462944", "versionEndExcluding": "1.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence \u2014 such as transactional flows like password resets or notifications \u2014 are affected. This issue has been fixed in version 1.5.1."}, {"lang": "es", "value": "El SDK de Node.js de Lettermint es el SDK oficial de Node.js para Lettermint. En las versiones 1.5.0 e inferiores, las propiedades del correo electr\u00f3nico (como 'para', 'asunto', 'html', 'texto' y 'archivos adjuntos') no se restablecen entre env\u00edos cuando una \u00fanica instancia de cliente se reutiliza en m\u00faltiples llamadas a .send(). Esto puede provocar que las propiedades de un env\u00edo anterior se filtren en uno posterior, entregando potencialmente contenido o direcciones de destinatarios a partes no deseadas. Las aplicaciones que env\u00edan correos electr\u00f3nicos a diferentes destinatarios en secuencia \u2014 como flujos transaccionales como restablecimientos de contrase\u00f1a o notificaciones \u2014 se ven afectadas. Este problema ha sido solucionado en la versi\u00f3n 1.5.1."}], "id": "CVE-2026-27492", "lastModified": "2026-06-17T10:27:14.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27492", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:08:16.795387Z", "version": "2.0.3"}}]}, "published": "2026-02-21T11:15:57.287", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-488"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "lettermint-node", "source": "cna", "vendor": "lettermint"}, "product": "lettermint-node", "vendor": "lettermint"}], "analysis": {"en": {"generated_at": "2026-04-18T11:19:06.162236+00:00", "value": {"mitigation_remediation": ["Upgrade the Lettermint SDK to version 1.5.1 or later where the issue has been fixed. ", "If upgrading immediately is not possible, instantiate a new client object on each set of transactions or explicitly reset email properties between calls. ", "Audit application code to ensure the SDK is not reused across independent email operations and that leak-prone properties are cleared after each send."], "summary": {"action": "Apply Update", "impact": "Unintended email data leakage"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Lettermint Node.js SDK (lettermint:lettermint-node) in all releases prior to 1.5.1, specifically version 1.5.0 and earlier. Developers using these versions in Node.js environments should verify the installed SDK version.", "description_and_impact": "The Lettermint Node.js SDK fails to clear email properties between successive .send() calls when the same client instance is reused. Properties such as to, subject, html, text, and attachments from a previous message remain attached to the next message, allowing confidential content or recipient addresses to be sent to unintended recipients. This flaw can expose sensitive email content and user addresses and may compromise confidentiality for applications that send transactional emails in rapid succession.", "risk_and_exploitability": "The CVSS score is 4.7, indicating moderate severity. The EPSS score is below 1%, suggesting a low exploitation likelihood at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating or using a single client instance and performing multiple sends; the second or later send will unintentionally leak data from the previous send. There are no additional prerequisites beyond normal application logic that reuses the client, making the attack path relatively straightforward."}}}}, "created": "2026-02-23T14:32:00.938192+00:00", "updated": "2026-04-18T11:30:44.309029+00:00", "vendors": ["lettermint", "lettermint$PRODUCT$lettermint-node"]}