The vulnerability arises from the massmail module rendering user‑controlled message subject and content fields through Django's Template() constructor without any sanitization. In message_previews.py, email_creators.py, and helpers.py, f‑strings embed the raw subject or content directly into a Template() call. An authenticated user who has rights to edit mass‑mail messages can inject Django template syntax ({{ }}, {% %}) which is evaluated when the message is rendered. This enables the attacker to read other users’ data, exfiltrate password hashes via the request context, forge CSRF tokens, or include arbitrary templates. Based on the description, the attack vector is inferred to be authenticated internal use via mass‑mail editing.

The affected product is DjangoCRM’s django‑crm, specifically the massmail module. The CVE data does not list specific version ranges, indicating that all releases that include the vulnerable code paths are impacted. No version information is available, so administrators should consider all installations of django‑crm that contain the massmail component as potentially affected.

With a CVSS score of 8.1, the vulnerability is considered High severity. The EPSS score is 0.00229, indicating a very low but nonzero likelihood of exploitation. Exploitation requires an authenticated user with mass‑mail edit permissions; based on the description, the attack vector is inferred to be privileged internal use. Despite the limited scope of the attacker’s privileges, the impact on data confidentiality and integrity is significant, making prompt remediation essential.