Description
MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 2.0.0-beta1, <= 2.1.0
References
Related Issues
- @hpke/core reuses AEAD nonces - CVE-2025-64767
- Spoofing attack in swagger-ui - CVE-2018-25031
- vxe-table prototype pollution - CVE-2024-57080
- Cross-Site Scripting in jquery - CVE-2020-7656
- Tags:
- npm
- maildev
Anything's wrong? Let us know Last updated on March 14, 2025