{"answers":{"affected":"3 open source packages ship an affected version, including mjml. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26151 exists.","fix":"Upgrade mjml to 0.11.0 or later.","what":"CVE-2024-26151 is a high-severity cross-site scripting vulnerability in FelixSchwarz mjml-python, published on 22 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-26151 and fix it if it is affected.\n\nWhat it is: CVE-2024-26151 is a high-severity cross-site scripting vulnerability in FelixSchwarz mjml-python, published on 22 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26151 exists.\n\nAffected packages and fixed versions:\n- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0\n- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0\n- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-26151/ (Markdown: https://insights.sbomify.com/CVE-2024-26151/index.md)","id":"CVE-2024-26151","markdown":"https://insights.sbomify.com/CVE-2024-26151/index.md","name":"CVE-2024-26151","record":{"aliases":["GHSA-578p-fxmm-6229","PYSEC-2026-1631"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Python MJML library","requires_auth":"low_privilege","summary":"Attackers can inject malicious HTML into emails via untrusted input in mjml-python templates, potentially executing scripts in recipients' email clients.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"mjml-python","vendor":"felixschwarz"}],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `\u0026lt;script\u0026gt;` would be rendered as `\u003cscript\u003e` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Potentially untrusted input is rendered as HTML in final output","id":"CVE-2024-26151","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2024"},"n_packages":3,"n_references":5,"next":{"headline":"Label Studio vulnerable to Cross-site Scripting if `\u003cChoices\u003e` or `\u003cLabels\u003e` are used in labeling config","id":"CVE-2024-26152"},"packages":[{"ecosystem":"PyPI","fixed":["0.11.0"],"introduced":["0.10.0"],"last_affected":[],"package":"mjml","purl":null,"source":"GHSA-578p-fxmm-6229"},{"ecosystem":"PyPI","fixed":["0.11.0"],"introduced":["0.10.0"],"last_affected":[],"package":"mjml","purl":"pkg:pypi/mjml","source":"GHSA-578p-fxmm-6229"},{"ecosystem":"PyPI","fixed":["0.11.0"],"introduced":["0.10.0"],"last_affected":[],"package":"mjml","purl":"pkg:pypi/mjml","source":"PYSEC-2026-1631"}],"prev":{"headline":"`@backstage/backend-common` vulnerable to path traversal through symlinks","id":"CVE-2024-26150"},"products":["mjml-python"],"published":"2024-02-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-22","vendors":["FelixSchwarz"]},"summary":"Attackers can inject malicious HTML into emails via untrusted input in mjml-python templates, potentially executing scripts in recipients' email clients.","url":"https://insights.sbomify.com/CVE-2024-26151/"}