CVE-2024-26151

CVSS 3.1 Score 8.2 of 10 (high)

Details

Published Feb 22, 2024
Updated: Feb 23, 2024
CWE ID 20

Summary

CVE-2024-26151 is a vulnerability that affects the mjml PyPI package found in the FelixSchwarz/mjml-python GitHub repository. This unofficial Python port of MJML, a markup language created by Mailjet, allows attackers to control the content of email messages sent through the platform if untrusted data is inserted into mjml templates without strict checking. The issue has been resolved in version 0.11.0 of the library, and versions prior to 0.10.0 are not affected. As a workaround, it is recommended to ensure that potentially untrusted user input does not contain any sequences that can be rendered as HTML. The vulnerability has a base severity rating of HIGH and an exploitability score of 2.3 out of 10, posing a potential danger to organizations using this package if left unaddressed.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-26151 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options