CVE-2024-26151

Untrusted data in mjml templates can lead to HTML injection vulnerabilities.

• CVSS 5.4
• CWE-79
• Input Validation and Sanitization
• Remote

The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `<script>` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.

CVE

CVE-2024-26151

CWE

CWE-79

CVSS base score

5.4

Published

2024-02-22

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

mjml-python

Fixed by upgrading

Yes

Solution

Upgrade to version 0.11.0 or later.

from mjml import mjml2html

user_input = "<script>alert('XSS');</script>"

mjml_template = f"""
<mjml>
  <mj-body>
    <mj-section>
      <mj-column>
        <mj-text>{user_input}</mj-text>
      </mj-column>
    </mj-section>
  </mj-body>
</mjml>
"""

html_output = mjml2html(mjml_template)

print(html_output)

import html
from mjml import mjml2html

user_input = "<script>alert('XSS');</script>"

sanitized_input = html.escape(user_input)

mjml_template = f"""
<mjml>
  <mj-body>
    <mj-section>
      <mj-column>
        <mj-text>{sanitized_input}</mj-text>
      </mj-column>
    </mj-section>
  </mj-body>
</mjml>
"""

html_output = mjml2html(mjml_template)

print(html_output)

<script>alert('XSS');</script>

@misc{vaitp:cve202426151,
  title        = {{Untrusted data in mjml templates can lead to HTML injection vulnerabilities.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-26151},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-26151/}}
}