MJML

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

MJML records in CISA KEV

No MJML vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records

TI-2024-16675 CVE-2024-25293 · GHSA-8w7r-5fhv-vwj9

HIGH 75

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.00994 Published 2024-03-01 No fix listed CWE-94

TI-2020-10195 CVE-2020-12827 · GHSA-4hch-r9xf-6vfr

LOW 37

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0266 Published 2020-06-17 Fixed in 4.6.3 CWE-22

TI-2025-41511 CVE-2025-67898 · GHSA-45h5-66jx-r2wf

LOW 20

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files.

CVSS 3.1MEDIUM 4.5 Local No auth No interaction EPSS 0.00258 Published 2025-12-14 Fixed in 5.0.0-alpha.9 CWE-36