CVE-2024-25293

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...

Potentially untrusted input is rendered as HTML in final output

ImpactAll users of mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like would be rendered as...

PYSEC-2026-1631 Potentially untrusted input is rendered as HTML in final output

Impact All users of mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like script would be rendered as in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which...

keble-email (>=0.0.1, <=0.0.4) potentially affected by CVE-2024-26151 via mjml (0.10.0)

mjml PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mjml and may be impacted: - keble-email =0.0.1, =0.0.4 Source cves: CVE-2024-26151 Source advisory: OSV:PYSEC-2026-1631...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

EUVD-2025-203312

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

@arikaim/cli (>=0.0.3, <=0.1.3), @arikaim/server (>=1.0.1, <=1.0.6) +26 more potentially affected by CVE-2020-12827 +1 more via mjml (>=5.0.0-alpha.1, <=5.0.0-alpha.6)

mjml NPM version =5.0.0-alpha.1, =0.0.3, =1.0.1, =11.1.0, =2.1.0, =0.2.0, =1.1.2-beta.9, =1.1.2-beta.9, =0.1.0, =1.1.2-beta.9, =1.1.2-beta.9, =0.1.0, =1.1.2-beta.9, =1.7.0-beta.3 and more Source cves: CVE-2020-12827, CVE-2025-67898 Source advisory: GHSA-45H5-66JX-R2WF...

@arikaim/cli (>=0.0.3, <=0.1.3), @arikaim/server (>=1.0.1, <=1.0.6) +26 more potentially affected by CVE-2025-67898 via mjml (>=5.0.0-alpha.1, <=5.0.0-alpha.6)

mjml NPM version =5.0.0-alpha.1, =0.0.3, =1.0.1, =11.1.0, =2.1.0, =0.2.0, =1.1.2-beta.9, =1.1.2-beta.9, =0.1.0, =1.1.2-beta.9, =1.1.2-beta.9, =0.1.0, =1.1.2-beta.9, =1.7.0-beta.3 and more Source cves: CVE-2025-67898 Source advisory: OSV:GHSA-45H5-66JX-R2WF...

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

GHSA-45H5-66JX-R2WF MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

Directory Traversal

Overview org.webjars.npm:mjml-core is a mjml-core Affected versions of this package are vulnerable to Directory Traversal via the ignoreIncludes parameter, which still defaults to false. An attacker can access arbitrary files by supplying crafted input that causes traversal outside the intended...

@27works/posto (>=2.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +842 more potentially affected by CVE-2025-67898 via mjml-core (>=2.3.3, <=6.0.0-alpha.1)

mjml-core NPM version =2.3.3, =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.122, =0.16.9, =1.0.4, =1.0.0, =0.0.1, =0.0.10, =1.0.0, =0.0.1, =2026.10.15-beta.1, =2026.10.17 and more Source cves: CVE-2025-67898 Source advisory: SNYK:JS-MJMLCORE-14417285...

Directory Traversal

Overview mjml-core is a mjml-core Affected versions of this package are vulnerable to Directory Traversal via the ignoreIncludes parameter, which still defaults to false. An attacker can access arbitrary files by supplying crafted input that causes traversal outside the intended directory. Detail...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

@27works/posto (>=2.0.0, <=2.0.2), @abdul778/page-editor (>=0.1.0, <=0.41.0) +653 more potentially affected by CVE-2025-67898 via mjml (>=0.1.0, <=5.0.0-alpha.6)

mjml NPM version =0.1.0, =2.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.122, =0.16.9, =1.0.4, =1.0.0, =0.0.3, =1.0.1, =2.0.0, =12.5.0, =14.0.3 - @bafsllc/backend-auth 1.0.0 and more Source cves: CVE-2025-67898 Source advisory: MEND:CVE-2025-67898...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...

CVE-2025-67898

CVE-2025-67898 affects MJML up to version 4.18.0, where the mj-include directive allows directory traversal to test file existence and, in type="css" cases, read files. The issue arises from an incomplete fix related to CVE-2020-12827. Several connected sources corroborate the exact behavior (dir...

PT-2025-51175

Name of the Vulnerable Software and Affected Versions MJML versions through 4.18.0 Description The software contains a directory traversal flaw within the mj-include functionality. This allows an attacker to check for the existence of files and, in cases where the type is set to "css", read files...