Executive brief
Plunk is an open-source email marketing platform. A security flaw in its campaign management tool allows users with limited access to insert malicious code into email templates. If an administrator or another team member views these templates, the code could execute in their browser, potentially allowing the attacker to hijack sessions or perform unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Plunk's campaign management feature. The root cause is the use of React's 'dangerouslySetInnerHTML' to render email body content in the admin dashboard without prior HTML sanitization. An authenticated attacker with low privileges can craft a malicious email body containing JavaScript. When an administrator or another user views the campaign in the dashboard, the script executes in their security context. This can lead to session hijacking or unauthorized administrative actions. The issue was addressed in version 0.9.0 by integrating DOMPurify for HTML sanitization.
Affected products
- useplunk Plunk < 0.9.0
Timeline
- 2026-04-20: patched: Version 0.9.0 released with DOMPurify integration.
- 2026-05-08: disclosed: CVE-2026-42192 published.