Vulnerability · Published Jun 17, 2020 · Assigned by mitre
CVE-2020-12827
High 7.2
In plain English
A high-severity security flaw in the mjml package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.2High
Exploit odds (30 days)2.7%top 14.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | mjml | 4.6.3 | GHSA-4hch-r9xf-6vfr |
Affected products (as reported)
References
- https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12 x_refsource_MISC
- https://github.com/mjmlio/mjml/releases/tag/v4.6.3 x_refsource_MISC
- https://twitter.com/mjmlio x_refsource_MISC
- https://mjml.io/community x_refsource_MISC
- https://rcesecurity.com x_refsource_MISC
- 20200616 [CVE-2020-12827] MJML <= 4.6.2 mj-include "path" Path Traversal mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html x_refsource_MISC