DjangoCRM's django-crm massmail module improperly handles user-controlled EmlMessage fields (subject, content) by rendering them through Django's Template constructor without sanitization in at least three locations: message_previews.py, email_creators.py, and helpers.py. This improper neutralization of special elements (CWE-1336) can lead to injection of malicious template code, potentially compromising confidentiality and integrity of the system. The vulnerability is tracked as CVE-2026-71239 with a CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). No patch or remediation guidance is currently provided by the vendor or advisory sources.

The vulnerability allows an attacker with at least low privileges (PR:L) and no user interaction (UI:N) to inject malicious template code via email message subject or content fields. Successful exploitation can lead to high confidentiality and integrity impact, such as unauthorized data disclosure or modification within the affected DjangoCRM system. Availability impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input in template rendering within the massmail module. Consider applying manual input sanitization or disabling the affected functionality if feasible.