{"id":"CVE-2025-59526","published":"2025-09-22T19:27:53Z","modified":"2025-09-22T19:45:47Z","title":"Mailgen: HTML injection vulnerability in plaintext e-mails","vendor":"eladnava","product":"mailgen","tier":"tail","description":{"text":"mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email).","provenance":"source","from":"CVE.org"},"cvss":{"score":2.7,"severity":"LOW","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00438,"percentile":0.37996,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d","tags":["x_refsource_MISC"]}],"priority":{"score":9.5,"factors":[{"name":"EPSS percentile","points":7.6},{"name":"CVSS severity","points":1.89}]},"vendorSlug":"eladnava","affectedVersions":[{"vendor":"eladnava","product":"mailgen","versions":["< 2.0.30"]}],"affected":[{"ecosystem":"npm","package":"mailgen","vulnerableRanges":["<2.0.30"],"patched":["2.0.30"],"from":["GHSA-j2xj-h7w5-r7vp"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-30449","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-eladnava-mailgen-cve-2025-59526","packageHistory":[{"cve":"CVE-2025-59526","published":"2025-09-22","fixed":"2.0.30","kev":false},{"cve":"CVE-2025-62366","published":"2025-10-14","fixed":"2.0.31","kev":false,"link":{"from":"CVE-2025-59526","to":"CVE-2025-62366","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:mailgen","fromFixed":"2.0.30","toFixed":"2.0.31","daysApart":22},{"kind":"similar","provenance":"machine","score":0.68,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-62380","published":"2025-10-15","fixed":"2.0.32","kev":false}],"package":"npm:mailgen"}}