CVE-2024-25293

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293	Exploit Third Party Advisory
https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mjml:mjml_app:3.0.4:::::::*
	cpe:2.3:a:mjml:mjml_app:3.1.0:beta::::::

History

13 May 2025, 14:40

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mjml:mjml_app:3.1.0:beta:::::: cpe:2.3:a:mjml:mjml_app:3.0.4:::::::*
First Time		Mjml mjml App Mjml
References	~~() https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293 -~~	() https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293 - Exploit, Third Party Advisory

21 Nov 2024, 09:00

Type	Values Removed	Values Added
References	~~() https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293 -~~	() https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293 -

06 Aug 2024, 16:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.3
CWE		CWE-94

01 Mar 2024, 14:04

Type	Values Removed	Values Added
Summary		(es) Se descubrió que las versiones 3.0.4 y 3.1.0-beta de mjml-app contienen una ejecución remota de código (RCE) a través del atributo href.

01 Mar 2024, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-01 06:15

Updated : 2025-05-13 14:40

NVD link : CVE-2024-25293

Mitre link : CVE-2024-25293

CVE.ORG link : CVE-2024-25293

JSON object : View

Products Affected

mjml

mjml_app

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

9.3 /10