Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

mjml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2PyPIAmendedPublished

    Potentially untrusted input is rendered as HTML in final output

    CVE-2024-26151 · GHSA-578p-fxmm-6229

    Affected
    • PyPI mjml >= 0.10.0, <= 0.10.0
    Fixed in
    0.11.0· Vendor fix available
    Issue
    Impact All users of mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like &lt;script&gt; would be rendered as <script in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. Patches The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue which was added as part of commit 84c495da20a91640a1ca551ace17df7f3be644aa. Workarounds - Ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML. References - Initial issue report by @sh-at-cs in #52

    Recommended action: Upgrade to 0.11.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →