CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

EUVD-2025-203312

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

GHSA-45H5-66JX-R2WF MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

@27works/posto (>=2.0.0 <=2.0.2), @abdul778/page-editor (>=0.1.0 <=0.41.0) +599 more potentially affected by CVE-2020-12827 +1 more via mjml (>=0.1.0 <=4.18.0)

mjml NPM version =0.1.0, =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.122, =0.16.9, =1.0.4, =1.0.0, =2.0.0, =12.5.0, =2.2.7-bb.3, =0.0.2, =0.4.3 and more Source cves: CVE-2020-12827, CVE-2025-67898 Source advisory: OSV:GHSA-45H5-66JX-R2WF...

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

Directory Traversal

Overview mjml-core is a mjml-core Affected versions of this package are vulnerable to Directory Traversal via the ignoreIncludes parameter, which still defaults to false. An attacker can access arbitrary files by supplying crafted input that causes traversal outside the intended directory. Detail...

@27works/posto (>=2.0.0 <=2.0.2), @abc45676/mailer (=1.0.0) +771 more potentially affected by CVE-2025-67898 via mjml-core (>=2.3.3 <=5.2.0)

mjml-core NPM version =2.3.3, =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.122, =0.16.9, =1.0.4, =1.0.0, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =0.0.3, =1.0.1, =1.0.6 and more Source cves: CVE-2025-67898 Source advisory: SNYK:JS-MJMLCORE-14417285...

Directory Traversal

Overview org.webjars.npm:mjml-core is a mjml-core Affected versions of this package are vulnerable to Directory Traversal via the ignoreIncludes parameter, which still defaults to false. An attacker can access arbitrary files by supplying crafted input that causes traversal outside the intended...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

CVE-2025-67898 affects MJML up to version 4.18.0, where the mj-include directive allows directory traversal to test file existence and, in type="css" cases, read files. The issue arises from an incomplete fix related to CVE-2020-12827. Several connected sources corroborate the exact behavior (dir...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

Mailjet MJML 安全漏洞

Mailjet MJML is a responsive email framework from the French company Mailjet. A security vulnerability exists in Mailjet MJML version 4.18.0 and earlier, which stems from mj-include allowing directory traversal, which could lead to testing for file existence and reading files...

PT-2025-51175

Name of the Vulnerable Software and Affected Versions MJML versions through 4.18.0 Description The software contains a directory traversal flaw within the mj-include functionality. This allows an attacker to check for the existence of files and, in cases where the type is set to "css", read files...

EUVD-2022-2384

Malicious code in bioql PyPI...

EUVD-2024-0518

Malicious code in bioql PyPI...

MAL-2025-26518 Malicious code in mjml-i18n (npm)

The package mjml-i18n was found to contain malicious code...

Malicious code in mjml-i18n (npm)

The package mjml-i18n was found to contain malicious code...

CVE-2024-25293

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution RCE via the href attribute...