Vulnerabilities

TI-2025-41511 CVE-2025-67898 · GHSA-45h5-66jx-r2wf

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in…

LOW 20

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files.

CVSS 3.1MEDIUM 4.5 Local No auth No interaction EPSS 0.00258 Published 2025-12-14 Fixed in 5.0.0-alpha.9 CWE-36

TI-2024-16675 CVE-2024-25293 · GHSA-8w7r-5fhv-vwj9

HIGH 75

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

CVSS 3.1CRITICAL 9.3 Local No auth No interaction EPSS 0.00994 Published 2024-03-01 No fix listed CWE-94

TI-2020-10195 CVE-2020-12827 · GHSA-4hch-r9xf-6vfr

LOW 37

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0266 Published 2020-06-17 Fixed in 4.6.3 CWE-22