CVE-2024-26151

Summary

CVE-2024-26151: The `mjml` PyPI package, before version 0.11.0, allows attackers to inject malicious HTML code into mjml templates. This vulnerability exists due to insufficient input validation. An attacker must provide untrusted data that is later used in an mjml template, which is then sent out as email. Potentially harmful user input like `<script>` would be rendered as `<script>` in the final output. This flaw could lead to the manipulation of email content sent through the platform. To mitigate this risk, users should ensure that untrusted user input does not contain any sequences that could be rendered as HTML. This issue has been resolved in version 0.11.0 of the library. Versions prior to 0.10.0 are not impacted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.