Medium severity4.5OSV Advisory· Published Dec 14, 2025· Updated Apr 15, 2026
CVE-2025-67898
CVE-2025-67898
Description
MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mjmlnpm | <= 4.18.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-45h5-66jx-r2wfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-12827ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-67898ghsaADVISORY
- github.com/mjmlio/mjml/issues/3018nvdWEB
News mentions
0No linked articles in our index yet.