CVE-2025-67898
1 advisory.
npm/mjml CVE-2025-67898: medium 4.5, EPSS 0.26%
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827
Action: Upgrade mjml to 5.0.0-alpha.9 or later.
npm i mjml@5.0.0-alpha.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.0-alpha.9 | - |
Fixed versions
| 5.0.0-alpha.9 |
Sources
- osv: GHSA-45h5-66jx-r2wf
- https://nvd.nist.gov/vuln/detail/CVE-2020-12827
- https://nvd.nist.gov/vuln/detail/CVE-2025-67898
- https://github.com/mjmlio/mjml/issues/3018
- https://github.com/mjmlio/mjml/pull/3033
- https://github.com/mjmlio/mjml/commit/517b376b068e71c713ec4bb4ef9e5b0b7235b8ce
- https://github.com/mjmlio/mjml
CVE-2025-67898 · published · modified · JSON