CVE-2024-26151
📋 TL;DR
CVE-2024-26151 is an input validation vulnerability in the mjml PyPI package that allows cross-site scripting (XSS) attacks when untrusted data is inserted into MJML templates. Attackers who can control data that gets injected into templates can execute arbitrary JavaScript in email recipients' browsers. All users of FelixSchwarz/mjml-python versions 0.10.0 to 0.10.x are affected.
💻 Affected Systems
- FelixSchwarz/mjml-python (mjml PyPI package)
📦 What is this software?
Mjml Python by Felixschwarz
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary JavaScript in email recipients' browsers, potentially stealing session cookies, credentials, or performing phishing attacks with legitimate-looking emails.
Likely Case
Email content manipulation allowing attackers to inject malicious scripts that execute when recipients view emails in vulnerable email clients.
If Mitigated
No impact if proper input validation/sanitization is implemented or if the vulnerable library is not used with untrusted data.
🎯 Exploit Status
Exploitation requires attacker to control input that gets inserted into MJML templates, which then gets sent as email to other users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.0
Vendor Advisory: https://github.com/FelixSchwarz/mjml-python/security/advisories/GHSA-578p-fxmm-6229
Restart Required: No
Instructions:
1. Update mjml package: pip install --upgrade mjml==0.11.0
2. Verify the update with: pip show mjml
3. Test email template rendering with sample malicious inputs to ensure proper escaping.
🔧 Temporary Workarounds
Input Sanitization Workaround
allImplement strict input validation and HTML entity escaping for all user-controlled data before inserting into MJML templates.
🧯 If You Can't Patch
- Implement server-side input validation to reject or sanitize HTML/JavaScript sequences in user input
- Use alternative email template systems that properly escape user input
🔍 How to Verify
Check if Vulnerable:
Check installed mjml version: pip show mjml | grep Version
If version is 0.10.0 to 0.10.x and you process untrusted user input in MJML templates, you are vulnerable.Check Version:
pip show mjml | grep VersionVerify Fix Applied:
After updating to 0.11.0, test with malicious input like '<script>alert(1)</script>' in MJML templates and verify it gets properly escaped in output HTML.📡 Detection & Monitoring
Log Indicators:
- Unusual email content patterns, unexpected HTML/script tags in email generation logs
Network Indicators:
- Emails containing unexpected script tags or JavaScript code
SIEM Query:
Search for email generation events with suspicious patterns like '<script>' or JavaScript code in template rendering logs🔗 References
- https://github.com/FelixSchwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa
- https://github.com/FelixSchwarz/mjml-python/commit/8d410b7a500703080bb14ed7e3d2663fe16767e6
- https://github.com/FelixSchwarz/mjml-python/issues/52
- https://github.com/FelixSchwarz/mjml-python/releases/tag/v0.11.0
- https://github.com/FelixSchwarz/mjml-python/security/advisories/GHSA-578p-fxmm-6229
- https://github.com/FelixSchwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa
- https://github.com/FelixSchwarz/mjml-python/commit/8d410b7a500703080bb14ed7e3d2663fe16767e6
- https://github.com/FelixSchwarz/mjml-python/issues/52
- https://github.com/FelixSchwarz/mjml-python/releases/tag/v0.11.0
- https://github.com/FelixSchwarz/mjml-python/security/advisories/GHSA-578p-fxmm-6229
- https://www.vicarius.io/vsociety/posts/cve-2024-26151-mjml-python-vulnerability-1
