# CVE-2024-26151: Potentially untrusted input is rendered as HTML in final output

> Attackers can inject malicious HTML into emails via untrusted input in mjml-python templates, potentially executing scripts in recipients' email clients.

- **Severity:** High 8.2 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 22 Feb 2024
- **Updated:** 22 Aug 2024
- **Also known as:** GHSA-578p-fxmm-6229, PYSEC-2026-1631

## What is CVE-2024-26151?

CVE-2024-26151 is a high-severity cross-site scripting vulnerability in FelixSchwarz mjml-python, published on 22 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

### Official description

The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `&lt;script&gt;` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.

Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-20 (Improper Input Validation)

## Which versions are affected by CVE-2024-26151?

3 open source packages ship an affected version, including mjml. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `mjml` | PyPI | From 0.10.0 | 0.11.0 |
| `mjml` | PyPI | From 0.10.0 | 0.11.0 |
| `mjml` | PyPI | From 0.10.0 | 0.11.0 |

Products: Felixschwarz Mjml-Python.

## How do I fix CVE-2024-26151?

Upgrade mjml to 0.11.0 or later.

## Is CVE-2024-26151 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26151 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-26151 and fix it if it is affected.

What it is: CVE-2024-26151 is a high-severity cross-site scripting vulnerability in FelixSchwarz mjml-python, published on 22 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26151 exists.

Affected packages and fixed versions:
- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0
- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0
- mjml (PyPI): affected from 0.10.0; fixed in 0.11.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-26151/ (Markdown: https://insights.sbomify.com/CVE-2024-26151/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-26151
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-26151
- OSV: https://osv.dev/vulnerability/CVE-2024-26151

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-26151/
Summaries are generated and may contain mistakes; the official description above is the record.