Starstruk Logo MarkStarstruk

@react-email/ui@6.3.3

resend/react-email@react-email/ui@6.3.3May 25, 2026by github-actions[bot]

AI Summary

Fixed a path traversal security vulnerability in the preview server by strictly validating file paths against the configured emails directory.

Key Highlights

  • Fixed path traversal vulnerability in preview server
  • renderEmailByPath and getEmailPathFromSlug now reject paths outside the configured directory

New Features

  • Path validation

Full Release Notes

### Patch Changes

* 86745ec: reject paths that resolve outside the configured emails directory in `renderEmailByPath` and `getEmailPathFromSlug` to close a path-traversal vector in the preview server