MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

中危 4.5CVE-2025-67898 · GHSA-45h5-66jx-r2wf · Published 14/12/2025 · updated 14/10/2026

要点

CVE-2025-67898 是影响 mjml 的中危 (CVSS 4.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.26%，高于 17.6% 的漏洞。
修复：升级到 5.0.0-alpha.9 或更高版本。

Package	Affected versions	Patched versions
mjml npm	`< 5.0.0-alpha.9`	`5.0.0-alpha.9`

Description

MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

NVD description

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

References

nvd.nist.gov/vuln/detail/CVE-2020-12827 · ADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-67898 · ADVISORY
mjmlio/mjml · WEB
mjmlio/mjml#3033 · WEB
mjmlio/mjml commit 517b376 · WEB
mjmlio/mjml · PACKAGE

mjml 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free