Mailgen CVE-2025-62366

Exploitation requires TWO specific conditions together: (1) the application calls Mailgen.generatePlaintext() with user-generated/attacker-influenced content, AND (2) the resulting 'plaintext' string is subsequently rendered or interpreted as HTML (in a browser, web client, or HTML email view) rather than displayed as literal text - this misuse of plaintext-as-HTML is the core enabling condition. The payload must use HTML-entity-encoded tags (e.g. &lt...&gt) to bypass the regex tag-stripper before he.decode() reactivates them. LIMITING FACTORS: if the output is used as true plaintext (its intended purpose), there is no impact; a victim must view the rendered output for JavaScript to execute; and only versions through 2.0.30 are affected (2.0.31+ is patched). No known workarounds exist short of upgrading.

This is a genuinely low-priority issue despite being a code-execution-capable XSS (CWE-79), and the multiple signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores only 2.9, driven down by AT:P (a specific attack requirement) and by impact being confined to the subsequent system (VC:N/VI:N/VA:N but SC:L/SI:L) - i.e. no impact on mailgen itself, only on a downstream rendering context. EPSS is low at 0.43% (35th percentile), the CVE is NOT on CISA KEV, and exploitation status is 'publicly available exploit code exists' (a working payload is published in the GHSA advisory) - note that POC availability is distinct from active exploitation, and there is no evidence of in-the-wild use. The key caveat: the real-world impact depends entirely on a condition the vector only partially captures - the generated 'plaintext' string must be misused by the consuming application as HTML. The CVSS vector shows UI:N, but realistic XSS execution requires a victim to view the rendered output, so the practical exploitability is lower than a naive reading of AV:N/PR:N/UI:N suggests. Overall: a legitimate defect worth patching, not an urgent emergency.

A developer uses Mailgen.generatePlaintext() with user-supplied content (e.g. a username or message) and then, by mistake, renders that 'plaintext' output as HTML in a web view or client. An attacker submits HTML-entity-encoded markup such as &ltimg src=xyz onerror=alert(1)&gt, which the tag-stripping regex misses and the he.decode() step turns back into a live <img> tag with an onerror handler, executing attacker JavaScript when the output is displayed. A working proof-of-concept payload is published in the GHSA advisory.