CVE-2025-62366: Mailgen HTML injection and XSS filter bypass in plaintext emails

CVE-2025-62366 · Severity: medium · CVSS 4 · Published 2025-10-14

Mailgen is a Node.js library that generates formatted email messages. An HTML injection vulnerability allows attackers to inject malicious HTML code (including XSS payloads) into plaintext emails by encoding HTML tags, which bypasses the library's sanitization filter. If the resulting plaintext output is rendered as HTML in a browser, an attacker can steal sensitive information or execute arbitrary code in the victim's browser context.

Technologies: mailgen (npm). Vendors: npm.

Quick answers

Is CVE-2025-62366 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62366 being exploited in the wild.
How severe is CVE-2025-62366?
Medium severity, with a CVSS score of 4, published 14 October 2025.
Which products and versions are affected?
mailgen (npm) SEMVER:introduced=0,fixed=2.0.31.
Is there a fix for CVE-2025-62366?
Yes. mailgen (npm): upgrade to 2.0.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62366 attacked?
It is attacked over the network.
Am I affected by CVE-2025-62366?
Check whether you run mailgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mailgen (npm): upgrade to 2.0.31 or later
    npm install mailgen@2.0.31

Technical details

The vulnerability is a classic encoding-based XSS filter bypass in the `generatePlaintext()` method. The vulnerable function attempts to strip HTML tags using a regex pattern that matches literal `<` and `>` characters, but it fails when these characters are HTML-encoded (e.g., `&lt;` and `&gt;`). The function then decodes HTML entities at the end, converting the encoded tags back into executable HTML. An attacker can inject a payload like `&amp;ltimg src=x onerror=alert(1)&amp;gt` into email fields, which passes through the filter as text but becomes valid HTML when rendered. The attack requires the application to use `generatePlaintext()` with user-supplied input and then render the output as HTML. Versions 2.0.30 and earlier are affected; version 2.0.31 includes a fix.

Affected products

  • Mailgen Mailgen <=2.0.30

Identifiers

  • CVE-2025-62366
  • GHSA-xw6r-chmh-vpmj

Timeline

  • 2025-10-14: disclosed
  • 2025-10-14: patched: Fix released in version 2.0.31

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.