MJML vulnerabilities

🔔 Create alert RSS

Published CVEs affecting MJML products: 2 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2025-67898 Medium · 4.5 CWE-36 Dec 14, 2025

MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827.

CVE-2020-12827 High · 7.2 CWE-22 Jun 17, 2020

MJML vulnerable to path traversal

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.