Plunk versions before 0.8.0 contain a CRLF header injection vulnerability in SESService.ts where user inputs for email headers and attachment filenames are directly interpolated into raw MIME messages without sanitization. Authenticated API users can exploit this by injecting carriage return and line feed characters to add arbitrary email headers such as Bcc or Reply-To, enabling manipulation of email behavior including silent forwarding and spoofing. The vulnerability is addressed in version 0.8.0 by enforcing input validation at the schema level to reject \r and \n characters in these fields, aligning with existing validation on other fields. The product is a cloud service built on AWS SES, and the vendor manages patching server-side.

Successful exploitation allows authenticated API users to inject arbitrary email headers, potentially causing silent email forwarding, reply redirection, or sender spoofing. This can compromise email integrity and confidentiality. The vulnerability does not impact availability. The CVSS score of 8.5 reflects high impact on confidentiality and limited impact on integrity, with no impact on availability.

A fix is available in plunk version 0.8.0, which adds input validation to reject carriage return and line feed characters in user-supplied email header fields and attachment filenames. Since plunk is a cloud-hosted service, the vendor manages remediation server-side. Users should ensure they are using version 0.8.0 or later. Check the vendor advisory for confirmation of patch deployment status. No additional mitigation is required if the service is updated.