Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-67898
CVE-2025-67898:
JavaScript vulnerability analysis and mitigation
Overview
CVE-2025-67898 is a directory traversal vulnerability in MJML (a responsive email framework) affecting versions through 4.18.0, specifically in the mj-include component. It allows local attackers to test for file existence and, when using type="css", read arbitrary files from the filesystem. This issue exists because of an incomplete fix for the earlier CVE-2020-12827, as the ignoreIncludes option continues to default to false. It was published on December 14, 2025, and carries a CVSS v3.1 base score of 4.5 (Medium) (Red Hat Advisory, GitHub Issue).
Technical details
The root cause is classified as CWE-36 (Absolute Path Traversal), stemming from insufficient path validation in MJML's mj-include directive. The original CVE-2020-12827 was partially addressed in commits between releases 4.6.2 and 4.6.3, but the ignoreIncludes option still defaults to false, leaving the traversal vector open. An attacker who can supply a crafted MJML template can use <mj-include path="../../../etc/passwd" /> to probe file existence via error feedback, and <mj-include path="../../../etc/passwd" type="css" /> to read and embed the file's contents verbatim into the rendered HTML output — with no error produced in the CSS case (GitHub Issue).
Impact
Successful exploitation allows an attacker to disclose the existence of arbitrary local files (information leakage via error/success differentiation) and, more critically, read the full contents of arbitrary files when the type="css" attribute is used, as the file content is included verbatim in the rendered HTML. This poses a confidentiality risk for sensitive files accessible to the process running MJML (e.g., configuration files, credentials, private keys). Integrity and availability impacts are rated low and low respectively, and there is no direct path to code execution based on current analysis (Red Hat Advisory, GitHub Issue).
Exploitability
No public exploit code or active in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access or the ability to supply attacker-controlled MJML templates to a vulnerable rendering pipeline (Red Hat Advisory).
Exploitation steps
- Identify a vulnerable target: Locate a system or service running MJML version ≤ 4.18.0 where an attacker can supply or influence MJML template content (e.g., a web application that renders user-supplied MJML templates).
- Probe file existence: Craft an MJML template containing
<mj-include path="../../../etc/shadow" />(or another target path). Submit it for rendering and observe whether an error is returned (file does not exist) or rendering succeeds (file exists), using the error feedback channel to enumerate files. - Read file contents via CSS include: Craft a template with
<mj-include path="../../../etc/passwd" type="css" />and submit it for rendering. The contents of the target file will be embedded verbatim into the<head>section of the rendered HTML output. - Exfiltrate data: Retrieve the rendered HTML output, which now contains the contents of the targeted file, and extract the sensitive information (GitHub Issue).
Indicators of compromise
- Logs: MJML rendering logs or application logs showing repeated rendering requests with
mj-includedirectives referencing paths outside the expected template directory (e.g.,../, absolute paths like/etc/). - File System: Unexpected access timestamps on sensitive files (e.g.,
/etc/passwd, configuration files,.envfiles) coinciding with MJML rendering activity. - Network/Application: Rendered HTML output containing content that does not match expected CSS or template data, particularly raw text resembling system file contents embedded in
<style>tags.
Mitigation and workarounds
No official patch has been confirmed as released for MJML through 4.18.0 at the time of this report, as the issue was disclosed as an incomplete fix for CVE-2020-12827. As a workaround, operators should set the ignoreIncludes option to true when invoking MJML programmatically to prevent processing of mj-include directives. Additionally, applications should avoid rendering untrusted or user-supplied MJML templates, and MJML processes should run with the least-privilege file system permissions possible to limit the scope of any file reads (GitHub Issue, Red Hat Advisory).
Community reactions
The vulnerability was reported by security researcher Sebastian (hartwork) via a GitHub issue, who noted that the original CVE-2020-12827 fix was effectively incomplete and that the default configuration remains vulnerable. The issue was cross-referenced by Hanno Böck, a known security researcher. Coverage has appeared on vulnerability aggregation platforms and a dedicated write-up was published at infinitsec.net. No official vendor statement or patch announcement from the MJML maintainers has been publicly issued as of the disclosure date (GitHub Issue, Infinitsec Write-up).
Additional resources
Source: This report was generated using AI
Related JavaScript vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management