CVE-2024-25293

The mjml-app versions 3.0.4 and 3.1.0-beta are vulnerable to Remote Code Execution (RCE) . The root cause is a security misconfiguration in the mj-button tag, where the href attribute allows for local code execution. Attackers can trigger the execution of local payloads (such as calc.exe or notep...