@react-email/editor@1.5.2

resend/react-email@react-email/editor@1.5.2May 27, 2026by github-actions[bot]

AI Summary

Enhanced security by sanitizing pasted HTML content to remove dangerous protocols, scripts, and tags that could be exploited.

Key Highlights

Scrubbed dangerous protocols (javascript:, vbscript:) and non-image data URLs
Removed malicious tags (script, iframe, object, embed, meta, base)
Applied sanitization on every paste to close a potential bypass

New Features

HTML sanitization on paste

Full Release Notes

### Patch Changes

* 0963d30: scrub `javascript:`, `vbscript:`, and non-image `data:` URLs from pasted HTML and drop `script`, `iframe`, `object`, `embed`, `meta`, and `base` elements. This pass now runs on every paste; previously, content carrying the editor's `node-*` class marker took a fast-path that skipped sanitization entirely and could be spoofed by hosting attacker HTML with the same class name. Legitimate intra-editor copy/paste still round-trips `class`, `style`, and `data-*` attributes as before.