CVE-2025-49136
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
Reserved 2025-06-02 | Published 2025-06-09 | Updated 2025-06-09 | Assigner GitHub_MCWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
github.com/...stmonk/security/advisories/GHSA-jc7g-x28f-3v3h
github.com/...ommit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e
github.com/knadh/listmonk/releases/tag/v5.0.2
Support options
