-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure processing of the mj-include directive's path attribute. The GitHub patch introduces an ignoreIncludes parameter to disable this feature by default, indicating the vulnerability resided in the include-handling logic within mjml2html. The function's pre-patch behavior allowed path traversal because it did not properly sanitize or restrict file paths when resolving includes. The commit modifies mjml2html in index.js to add this safeguard, confirming this as the entry point for the vulnerable functionality.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mjml | npm | < 4.6.3 | 4.6.3 |
JavaScriptJavaScriptOngoing coverage of React2Shell