CVE-2025-62366
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| eladnava | mailgen | 2.0.32 |
| eladnava | mailgen | 2.0.31 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an HTML injection and Cross-Site Scripting (XSS) filter bypass in the Mailgen Node.js package, specifically in the generatePlaintext method. The method tries to remove HTML tags from user-supplied content to produce plaintext emails, but it fails to remove encoded HTML entities. These encoded entities are later decoded, resulting in active HTML tags (like an img tag with an event handler) in the plaintext output. If this plaintext is rendered as HTML, it can execute attacker-controlled JavaScript. [2]
How can this vulnerability impact me? :
If the plaintext email generated by Mailgen is rendered in an HTML context, this vulnerability can allow execution of arbitrary JavaScript controlled by an attacker. This can lead to exposure of sensitive information or enable further attacks such as Cross-Site Scripting (XSS). The actual impact depends on how the plaintext output is used in your environment. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the version of the Mailgen package used in your system. If the version is 2.0.30 or earlier, it is vulnerable. Additionally, you can look for suspicious encoded HTML entities in plaintext emails generated by the generatePlaintext method, such as encoded img tags with event handlers (e.g., <img src=x onerror=alert(document.body.innerHTML)>). There are no specific commands provided in the resources, but you can use package management commands like `npm list mailgen` to check the installed version. For inspecting emails, you might search for encoded HTML entities in email logs or outputs. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the Mailgen package to version 2.0.31 or later, where the issue has been fixed. No known workarounds exist, so updating is the recommended action to prevent HTML injection and XSS attacks via the generatePlaintext method. [2]