{"id":"GHSA-45h5-66jx-r2wf","revision":"5a4d47c264db433f8e501f319b789f25","records":[{"revision":"5a4d47c264db433f8e501f319b789f25","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-45h5-66jx-r2wf","aliases":["CVE-2025-67898"],"title":"MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827","description":"MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and (in the type=\"css\" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.","state":0,"publishedAt":"2025-12-15T00:30:25+00:00","modifiedAt":"2026-09-10T03:50:31.3957855+00:00","affected":[{"ecosystem":"npm","name":"mjml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.0.0-alpha.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-12827","https://nvd.nist.gov/vuln/detail/CVE-2025-67898","https://github.com/mjmlio/mjml/issues/3018","https://github.com/mjmlio/mjml/pull/3033","https://github.com/mjmlio/mjml/commit/517b376b068e71c713ec4bb4ef9e5b0b7235b8ce","https://github.com/mjmlio/mjml"],"sourceUrl":"https://github.com/advisories/GHSA-45h5-66jx-r2wf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-45h5-66jx-r2wf","identifiers":["GHSA-45h5-66jx-r2wf","CVE-2025-67898"]},"retained":false,"historicalAffected":[]}],"coverage":[]}