Threats tagged 'ghsa-5gqw-c8wj-82xp'

zbateson mail-mime-parser versions before 3.0.9 and 4.x before 4.0.6 have a CRLF header injection vulnerability. This flaw occurs in message-building helpers that do not properly strip carriage return (CR) and line feed (LF) characters. An attacker can exploit this by supplying crafted MIME type, charset, encoding, micalg, or protocol values to inject additional header lines, such as a forged Bcc, into outgoing email messages.