CVE-2020-12827: MJML vulnerable to path traversal – CVSS 7.2 · Watchpost

← All vulnerabilities

MJML vulnerable to path traversal

高危 7.2CVE-2020-12827 · GHSA-4hch-r9xf-6vfr · Published 17/06/2020 · updated 17/06/2026

要点

CVE-2020-12827 是影响 mjml (mjml), mjml 的高危 (CVSS 7.2)漏洞。
未来 30 天内被利用的概率（EPSS）：2.7%，高于 85.8% 的漏洞。
修复：升级到 4.6.3 或更高版本。

Package	Affected versions	Patched versions
mjml mjml	`< 4.6.3`	`4.6.3`
mjml npm	`< 4.6.3`	`4.6.3`

Description

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.

NVD description

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.

References

nvd.nist.gov/vuln/detail/CVE-2020-12827 · ADVISORY
mjmlio/mjml commit 30e29ed · WEB
mjmlio/mjml · PACKAGE
mjmlio/mjml release v4.6.3 · WEB
packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html · WEB
seclists.org/fulldisclosure/2020/Jun/23 · WEB
mjml.io/community · Vendor Advisory
rcesecurity.com · Broken Link
twitter.com/mjmlio · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free