PT-2025-41969 · Mailgen · Mailgen

Published 2025-10-14 · Updated 2025-10-15 · CVE-2025-62366

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions mailgen versions through 2.0.30

Description mailgen is a Node.js package used to generate responsive HTML e-mails. Versions through 2.0.30 have an issue where the generatePlaintext function does not properly remove encoded HTML entities from user-supplied content. This can lead to the inclusion of active HTML, such as an img tag with an event handler, in the plaintext output. If this output is then rendered as HTML, it could allow the execution of attacker-controlled JavaScript. The function attempts to remove HTML tags, but encoded HTML entities bypass this process and are later decoded.

Recommendations Update to version 2.0.31 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62366

GHSA-XW6R-CHMH-VPMJ

Affected Products

Mailgen

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62366.json · Exploit
• https://osv.dev/vulnerability/GHSA-xw6r-chmh-vpmj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62366 · Security Note
• https://github.com/eladnava/mailgen · Note
• https://github.com/eladnava/mailgen/commit/7279a983481d05c51aa451e86146f98aaa42fee9 · Note
• https://github.com/eladnava/mailgen/security/advisories/GHSA-xw6r-chmh-vpmj · Note
• https://twitter.com/CVEnew/status/1978123681210536445 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post
• https://t.me/CVEtracker/34874 · Telegram Post