Mailgen CVE-2025-62380

Exploitation requires that (1) the application calls Mailgen.generatePlaintext with attacker-controllable/untrusted input, AND (2) the returned string - which the API advertises as plaintext - is subsequently rendered or processed in a context where HTML is interpreted (e.g. an HTML email preview or web view). The injected tag must contain a Unicode line separator (U+2028) or similar character that evades the pre-patch tag-stripping regex. The limiting factor is condition (2): if the output is used strictly as plaintext (the intended use), there is no impact - this is why the CVSS 4.0 vector carries AT:P and the overall score is only 2.9. Affects Mailgen <= 2.0.31 (Node.js); fixed in 2.0.32.

This is a genuinely low-priority issue despite being an XSS-class flaw. The CVSS 4.0 base score of 2.9 is itself low, driven by VC:N/VI:N/VA:N on the vulnerable system and only SC:L/SI:L on a subsequent system (the victim's browser) - i.e. no direct impact on the Mailgen host, only limited impact downstream when the output is mishandled. The 4.0 vector carries AT:P (an attack requirement), which correctly reflects that exploitation depends on a condition outside the attacker's control: the consuming application must render the string returned by generatePlaintext in an HTML-interpreted context, which is a developer misuse of an API that explicitly produces 'plaintext'. EPSS is 0.45% (37th percentile) - modest and consistent with a niche library bug rather than a mass-exploited target. Exploitation status: publicly available exploit code exists (a working payload <img src=x onerror=alert(1)\u2028> is published in the GHSA advisory), but this is NOT active exploitation - there is no CISA KEV listing. POC availability and active exploitation are distinct signals; do not conflate them. The E:P (Proof-of-Concept exploit maturity) in the vendor vector aligns with the published PoC. Net: real but low-severity, contingent on insecure downstream handling; prioritize via normal dependency-update hygiene, not emergency patching.

An attacker submits user-generated content (e.g. a display name, comment, or form field) containing an HTML tag with an embedded Unicode line separator such as <img src=x onerror=alert(1)\u2028>. A transactional-email backend passes that content to Mailgen.generatePlaintext; the regex tag-stripper fails to match the tag because of the U+2028 character, and he.decode later restores it to valid HTML. If the application then renders that supposedly-plaintext string in an HTML context (e.g. a web mail preview), the script executes in the victim's browser. A working PoC payload is published in the GHSA advisory.