Use render html: instead of inline:

[Andrew Cantino]

By using render inline: here you may be introducing a RCE since it will evaluate ERB.

rails_email_preview/app/controllers/rails_email_preview/emails_controller.rb

Line 70 in 723c126

 render inline: body, layout: 'rails_email_preview/email' 

Is that intended?

[Gleb Mazovetskiy]

Good catch!

[Gleb Mazovetskiy]

Fixed, released in https://github.com/glebm/rails_email_preview/releases/tag/v2.2.2

[Andrew Cantino]

👍