Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
Date: 2025-10
Affected: npm/mailgen
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-62366
CVE-2025-62380
CWE: CWE-79

### Summary An HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Projecta are affected if the `Mailgen.generatePlaintext(email)` method is used and passed in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt). ### Details The following function (inside index.js) is intended to strip all HTML content to produce a plaintext string. ```javascript // Plaintext text e-mail generator Mailgen.prototype.generatePlaintext = function (params) { // Plaintext theme not cached? if (!this.cachedPlaintextTheme) { throw new Error('An error was encountered while loading the plaintext theme.'); } // Parse email params and get back an object with data to inject var ejsParams = this.parseParams(params); // Render the plaintext theme with ejs, injecting the data accordingly var output = ejs.render(this.cachedPlaintextTheme, ejsParams); // Definition of the <br /> tag as a regex pattern var breakTag = /(?:\<br\s*\/?\>)/g; var breakTagPattern = new RegExp(breakTag); // Check the plaintext for html break tag, maintains backwards compatiblity if (breakTagPattern.test(this.cachedPlaintextTheme)) { // Strip all linebreaks from the rendered plaintext output = output.replace(/(?:\r\n|\r|\n)/g, ''); // Replace html break tags with linebreaks output = output.replace(breakTag, '\n'); // Remove plaintext theme i


Mitigations:

Architectural layers (MAESTRO):