fkie_cve-2025-62380

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.31 contain an HTML injection vulnerability in plaintext emails generated with the generatePlaintext method when user generated content is supplied. The plaintext generation code attempts to strip HTML tags using a regular expression and then decodes HTML entities, but tags that include certain Unicode line separator characters are not matched and removed. These encoded tags are later decoded into valid HTML content, allowing unexpected HTML to remain in output intended to be plaintext. Projects are affected if they call Mailgen.generatePlaintext with untrusted input and then render or otherwise process the returned string in a context where HTML is interpreted. This can lead to execution of attacker supplied script in the victim’s browser. Version 2.0.32 fixes the issue.

GHSA-q4w9-x3rv-4c8j — Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails

Affected: npm: mailgen

### Summary

An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Projecta are affected if the `Mailgen.generatePlaintext(email)` method is used and passed in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).

### Details

The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string.

```javascript // Plaintext text e-mail generator Mailgen.prototype.generatePlaintext = function (params) { // Plaintext theme not cached? if (!this.cachedPlaintextTheme) { throw new Error('An error was encountered while loading the plaintext theme.'); } // Parse email params and get back an object with data to inject var ejsParams = this.parseParams(params);

// Render the plaintext theme with ejs, injecting the data accordingly var output = ejs.render(this.cachedPlaintextTheme, ejsParams);

// Definition of the <br /> tag as a regex pattern var breakTag = /(?:\<br\s*\/?\>)/g; var breakTagPattern = new RegExp(breakTag);

// Check the plaintext for html break tag, maintains backwards compatiblity if (breakTagPattern.test(this.cachedPlaintextTheme)) { // Strip all linebreaks from the rendered plaintext output = output.replace(/(?:\r\n|\r|\n)/g, '');

// Replace html break tags with linebreaks output = output.replace(breakTag, '\n');

// Remove plaintext theme…

Most recent entries from all

fkie_cve-2025-62380

GHSA-q4w9-x3rv-4c8j — Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails