Starstruk Logo MarkStarstruk

@react-email/editor@1.4.8

resend/react-email@react-email/editor@1.4.8May 25, 2026by github-actions[bot]

AI Summary

A security patch is included to prevent prototype pollution in the email-theming plugin while updating the core library.

Key Highlights

  • Fixes prototype pollution vulnerability in the email-theming plugin.
  • Prevents attacker-controlled keys from mutating Object.prototype.
  • Updates react-email dependency to version 6.3.3.

Full Release Notes

### Patch Changes

* f355fba: prevent prototype pollution in the email-theming plugin by building `cssJS` and merged theme objects from `Object.create(null)` so attacker-controlled `__proto__`, `constructor`, or `prototype` keys in panel-style input become regular own properties instead of mutating `Object.prototype`
  * react-email@6.3.3