Mailgen HTML Injection Vulnerability in Plaintext Emails

A vulnerability allowing HTML injection in plaintext emails has been identified in the Mailgen Node.js package, prior to version 2.0.30. This issue arises when the 'Mailgen.generatePlaintext(email)' method is used with user-generated content, creating a risk for projects that rely on this functionality.

Impact

Exploitation of this vulnerability allows for HTML injection in plaintext emails, which could be misused to manipulate email content or formatting.

Remediation

Users can upgrade to Mailgen version 2.0.30 or later to address this vulnerability. Alternatively, HTML tags can be stripped from content before it is passed to the 'Mailgen.generatePlaintext(email)' method.