{"id":"EUVD-2025-30449","enisaUuid":"278eff8c-d7e2-31cf-b875-53831bdd618d","description":"mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email).","datePublished":"Sep 22, 2025, 7:27:53 PM","dateUpdated":"Sep 22, 2025, 7:45:47 PM","baseScore":2.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:U","references":"https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp\nhttps://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d\n","aliases":"CVE-2025-59526\nGHSA-j2xj-h7w5-r7vp\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"baa83be4-0471-3931-8d6e-f862150de939","product":{"name":"mailgen","vendor":{"name":"eladnava"}},"product_version":"\u003c 2.0.30"}],"enisaIdVendor":[{"id":"422734ca-0423-36de-87f1-06518e017fb0","vendor":{"name":"eladnava"}}],"enisaIdVulnerability":[{"id":"7f51154b-5b05-37a1-b7eb-282e31f79ea2","vulnerability":{"id":"GHSA-j2xj-h7w5-r7vp","description":"Mailgen: HTML injection vulnerability in plaintext e-mails","datePublished":"Sep 22, 2025, 6:03:47 PM","dateUpdated":"Sep 23, 2025, 8:50:37 PM","baseScore":0.0,"references":"https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59526\nhttps://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d\nhttps://github.com/eladnava/mailgen\n","enisa_id":"EUVD-2025-30449\n","aliases":"CVE-2025-59526\nGHSA-j2xj-h7w5-r7vp\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fe38c461-600c-3c6b-b27b-e87f7b0784be","vulnerability":{"id":"CVE-2025-59526","description":"mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Prior to version 2.0.30, there is an HTML injection vulnerability in plaintext e-mails generated by Mailgen. Projects are affected if the Mailgen.generatePlaintext(email) method is used and given user-generated content. This vulnerability has been patched in version 2.0.30. A workaround involves stripping all HTML tags before passing any content into Mailgen.generatePlaintext(email).","datePublished":"Sep 22, 2025, 7:27:53 PM","dateUpdated":"Sep 22, 2025, 7:45:47 PM","status":"PUBLISHED","baseScore":2.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:U","references":"https://github.com/eladnava/mailgen/security/advisories/GHSA-j2xj-h7w5-r7vp\nhttps://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d\n","enisa_id":"EUVD-2025-30449\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Oct 31, 2026, 7:14:03 AM","vulnerabilityProduct":[{"id":"7fafa7ac-e48a-4532-b1f4-9b53fec4bc37","product":{"name":"mailgen","vendor":{"name":"eladnava"}},"product_version":"\u003c 2.0.30"},{"id":"8657b2dc-b1a1-3d1b-a80e-8dae03386755","product":{"name":"mailgen","vendor":{"name":"eladnava"}},"product_version":"\u003c 2.0.30"}],"vulnerabilityVendor":[{"id":"e4af1fca-9e43-3a39-a18b-87f2e7b9be93","vendor":{"name":"eladnava"}}]}}],"enisaIdAdvisory":[]}