4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67898

CVE-2025-67898: MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67898

CVE-2025-67898:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mjml	npm	<= 4.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a directory traversal in the handling of mj-include tags in MJML. The analysis of the provided information, including the GitHub issue and the related commits, reveals the following:

The root cause of the vulnerability is the lack of sanitization of the path attribute of the mj-include tag. An attacker can provide a payload like ../../../../../../etc/passwd to traverse the directory structure and access arbitrary files on the filesystem.

The vulnerability is triggered through the following call chain:

The mjml2html function in packages/mjml-core/src/index.js is the main API for converting MJML to HTML. It receives the malicious MJML input.
mjml2html calls MJMLParser in packages/mjml-parser-xml/src/index.js to parse the input.
Inside MJMLParser, when an mj-include tag is found, the code extracts the path attribute and passes it to a handleInclude function. The path is not sanitized before being used.
The handleInclude function reads the file from the provided path. The GitHub issue confirms that if the type attribute of the mj-include tag is set to css, the content of the file is included verbatim in the output, leading to arbitrary file disclosure.

The commits provided are related to a previous, incomplete fix for a similar vulnerability (CVE-2020-12827). The fix introduced an ignoreIncludes option, but this does not address the path traversal vulnerability itself and is not a secure default. Therefore, the application remains vulnerable.

Based on this analysis, the functions mjml2html and MJMLParser would appear in a runtime profile when the vulnerability is exploited. MJMLParser is the function that directly handles the malicious input, and mjml2html is the public-facing function that initiates the process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.