Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Projecta are affected if the Mailgen.generatePlaintext(email) method is used and passed in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt). Details The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string. The process fails because it searches for HTML tags and attempts to strip them from the input. However, if the unicode encoded characters are present inside HTML tags, they are not removed. These encoded tags are then decoded later and become valid HTML content, which can lead to XSS vulnerabilities. A valid payload is: <img src=x onerror=alert(1)\u2028. PoC Resulting output file (emailText.html): Impact Depending on the context/environment where the plaintext message is used, if HTML is rendered and executed can result in arbitrary code execution in the browser of the victim…
Recommended action: Upgrade to 2.0.32 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Your project is affected if you use the Mailgen.generatePlaintext(email) method and pass in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt). Details The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string. The process fails because it searches for HTML tags and attempts to strip them from the input. However, if the HTML tags are encoded, they are not removed. These encoded tags are then decoded later and become valid HTML content, which can lead to XSS vulnerabilities. A valid payload is: <img src=xyz onerror=alert(1)>. PoC Resulting output file (emailText.html): Impact Depending on the context/environment where the plaintext message is used, if HTML is rendered and executed can result in arbitrary code execution in the browser of the victim (potentially stealing secrets or…
Recommended action: Upgrade to 2.0.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HTML Injection and XSS Filter Bypass in Plaintext Emails Summary An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Your project is affected if you use the Mailgen.generatePlaintext(email); method and pass in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt). Vulnerability Analysis The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string. The process fails because it first converts HTML break tags to newlines and then attempts to strip HTML tags with a regular expression. Using a break tag inside another HTML tag can deceive the filter, allowing HTML content to be injected into the email. A valid payload is: <img<br src=xyz onerror=alert(1). Proof of Concept Resulting output file (emailText.txt): Mitigation The vulnerability has been patched in commit 741a019 and released to npm in version 2.0.30. Thanks to Edoardo Ottavianelli (@edoardottt)…
Recommended action: Upgrade to 2.0.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.