listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the {{ env }} template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/knadh/listmonkGo | >= 4.0.0, < 5.0.2 | 5.0.2 |
Affected products
1Patches
1d27d2c32cf3aRemove dangerous tpl funcs in Sprig that's enabled by default.
2 files changed · +10 −2
cmd/init.go+5 −1 modified@@ -988,7 +988,11 @@ func initTplFuncs(i *i18n.I18n, u *UrlConfig) template.FuncMap { } // Copy spring functions. - maps.Copy(funcs, sprig.GenericFuncMap()) + sprigFuncs := sprig.GenericFuncMap() + delete(sprigFuncs, "env") + delete(sprigFuncs, "expandenv") + + maps.Copy(funcs, sprigFuncs) return funcs }
internal/manager/manager.go+5 −1 modified@@ -621,7 +621,11 @@ func (m *Manager) makeGnericFuncMap() template.FuncMap { } // Copy spring functions. - maps.Copy(funcs, sprig.GenericFuncMap()) + sprigFuncs := sprig.GenericFuncMap() + delete(sprigFuncs, "env") + delete(sprigFuncs, "expandenv") + + maps.Copy(funcs, sprigFuncs) return funcs }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-jc7g-x28f-3v3hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-49136ghsaADVISORY
- github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3eghsax_refsource_MISCWEB
- github.com/knadh/listmonk/releases/tag/v5.0.2ghsax_refsource_MISCWEB
- github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3hghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.