Vulnerability Database
296,663
Total vulnerabilities in the database
CVE-2025-59526
Impact
An HTML injection vulnerability in plaintext e-mails generated by Mailgen has been discovered. Your project is affected if you make use of the Mailgen.generatePlaintext(email); method and pass in user-generated content. The issue has been discovered and reported by Edoardo Ottavianelli (@edoardottt).
Patches
The vulnerability has been patched in commit https://github.com/eladnava/mailgen/commit/741a0190ddae0f408b22ae3b5f0f4c3f5cf4f11d and released to npm in version 2.0.30.
Workarounds
Strip all HTML tags yourself before passing any content into Mailgen.generatePlaintext(email);.
Thanks to Edoardo Ottavianelli (@edoardottt) for discovering and reporting this vulnerability.
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime