CVE-2025-62366

Vulnerability

Mailgen through version 2.0.30 contains an HTML injection vulnerability in the generatePlaintext method, which is intended to produce plaintext versions of generated emails. The issue arises because the method strips HTML tags before decoding HTML entities. If a user supplies encoded HTML entities (e.g., <img src=x onerror=alert(1)>), they bypass the tag removal and later become decoded into active HTML, resulting in a plaintext output that actually contains markup [1][2][3].

Exploitation

An attacker can exploit this by injecting specially crafted user-generated content into the email parameters passed to generatePlaintext. Since the method does not sanitize encoded entities prior to tag removal, the attacker's encoded tags survive the filtering and are decoded into valid HTML. This plaintext string, if subsequently rendered as HTML (for example, in a webmail client that displays plaintext as HTML), could execute attacker-controlled JavaScript [2][3]. No authentication or special network position is required beyond the ability to supply user content to the email generation function.

Impact

Successful exploitation could lead to cross-site scripting (XSS) when the generated plaintext email is rendered as HTML. This could allow an attacker to execute arbitrary JavaScript in the context of the recipient's email client or web application, potentially stealing session cookies, defacing pages, or performing other malicious actions [2][3].

Mitigation

The vulnerability is fixed in Mailgen version 2.0.31. The fix reorders operations: HTML entities are decoded first, then tags are stripped, preventing encoded tags from escaping [4]. No workarounds exist; users should update to 2.0.31 or later [2][3].