Read the docs
TI-2025-37057 Aliases CVE-2025-59526GHSA-j2xj-h7w5-r7vp

Mailgen: HTML injection vulnerability in plaintext e-mails

Priority LOW 20CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00438 38th percentileScored 2026-11-07
Fix Fixed mailgen (eladnava): 2.0.30mailgen (npm): 2.0.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
eladnavamailgenbefore 2.0.302.0.30Patch availableCNA
—mailgen (npm)before 2.0.302.0.30Patch availableGHSA-j2xj-h7w5-r7vp
  • mailgen Vendoreladnava Affected before 2.0.30 Fixed in 2.0.30 Patch available CNA
  • mailgen (npm) Vendor— Affected before 2.0.30 Fixed in 2.0.30 Patch available GHSA-j2xj-h7w5-r7vp

Remediation

  • Fix · CNA mailgen (eladnava) Fixed in 2.0.30
  • Fix · GHSA-j2xj-h7w5-r7vp mailgen (npm) Fixed in 2.0.30 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59526
  2. 2026-10-03 Alias added: GHSA-j2xj-h7w5-r7vp

References

Advisory 1

Other 3

  • TI-2025-38647 Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails CVSS 4.0LOW 2.9
  • TI-2025-38634 Mailgen vulnerable to HTML injection and cross-site scripting via plaintext email generation CVSS 4.0LOW 2.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences