Vulnerability · Published Sep 22, 2025 · Assigned by GitHub_M

CVE-2025-59526Mailgen: HTML injection vulnerability in plaintext e-mails

Low 2.7

In plain English

A low-severity cross-site scripting in mailgen from eladnava. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	mailgen	2.0.30	GHSA-j2xj-h7w5-r7vp

Affected products (as reported)

Vendor	Product	Versions
eladnava	mailgen	< 2.0.30

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:U

References

https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp x_refsource_CONFIRM
https://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d x_refsource_MISC