PT-2025-42387 · Mailgen · Mailgen

Published 2025-10-15 · Updated 2025-10-16 · CVE-2025-62380

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions mailgen versions through 2.0.31

Description mailgen is a Node.js package used to generate responsive HTML emails. A flaw exists in the plaintext email generation process when using the generatePlaintext method with untrusted input. The code attempts to remove HTML tags using a regular expression and then decodes HTML entities, but certain Unicode line separator characters within tags are not removed. These encoded tags are subsequently decoded into valid HTML, allowing unexpected HTML to remain in the plaintext output. This can lead to the execution of attacker-supplied script in a victim’s browser if the resulting string is processed in a context where HTML is interpreted.

Recommendations Update to version 2.0.32 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62380

GHSA-Q4W9-X3RV-4C8J

Affected Products

Mailgen

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62380.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62380 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4w9-x3rv-4c8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62380 · Security Note
• https://github.com/eladnava/mailgen/security/advisories/GHSA-q4w9-x3rv-4c8j · Note
• https://github.com/eladnava/mailgen · Note
• https://github.com/eladnava/mailgen/commit/7a791a424ff3a3f7783f8750919f1e98639924a8 · Note
• https://t.me/CVEtracker/35031 · Telegram Post
• https://twitter.com/CVEnew/status/1978545032451039688 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978660746603966886 · Twitter Post