MailDev Remote Code Execution

Description

MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 2.0.0-beta1, <= 2.1.0

References

• GHSA-vc6q-ccj9-9r89
• intrix.com.au
• CVE-2024-27448
• CWE-22
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• jsPDF Denial of Service (DoS) - CVE-2025-57810
• vxe-table prototype pollution - CVE-2024-57080
• Cross-Site Scripting in jquery - CVE-2020-7656
• Cache Poisoning Vulnerability - CVE-2024-29042

Tags:

npm

maildev