DjangoCRM's massmail module in django-crm renders user-controlled EmlMessage fields (subject, content) via Django's Template() constructor without sanitization in at least three locations: message_previews.py, email_creators.py, and helpers.py. Authenticated users with mass-mail message edit permissions can inject Django template syntax ({{ }} / {% %}) that executes during template rendering. This improper neutralization of special elements (CWE-1336) enables attackers to disclose sensitive data such as other users' information and password hashes through request context variables, perform CSRF token forgery, and include arbitrary registered templates. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality and integrity.

An attacker with authenticated mass-mail message edit rights can exploit this vulnerability to execute arbitrary Django template code. This can lead to unauthorized disclosure of sensitive user data including password hashes, forgery of CSRF tokens, and inclusion of arbitrary templates, compromising confidentiality and integrity of the system. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict mass-mail message edit permissions to trusted users only to reduce risk. Avoid rendering user-controlled input directly with Django's Template() constructor without proper sanitization or escaping.