Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities?


The user says their email address is foo. The link on the page (which is visible to everyone), will be be: <a href="mailto:foo">foo</a>.

I'm interested to know if there is a way to exploit this thing.

1 Answer 1


What if they entered their email as

"></a><script>alert("XSS")</script><a href="

which (might) be rendered by the application as

<a href="mailto:"></a><script>alert("XSS")</script><a href="">"></a><script>alert("XSS")</script><a href="</a>.

giving rise to a Stored XSS vulnerability.

To prevent this, the application should URL percent encode and then HTML encode the email value.

  • That's a good point. However, that's an encoding issue. Are there other ways to exploit this case? May 19, 2015 at 10:51
  • @IonicăBizău perhaps you need to define your scope of "exploit" - this answer shows a way to exploit the HTML.
    – schroeder
    May 19, 2015 at 15:26
  • @schroeder I'm just curious if there's a way to break the things since the email is not validated. May 19, 2015 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.