CVE-2026-34975

Plunk, an open-source email platform built on AWS SES, contains a CRLF header injection vulnerability in versions prior to 0.8.0. The flaw exists in SESService.ts where user-supplied input in sender names, email subjects, custom headers, and attachment filenames are directly interpolated into MIME messages without sanitization. An authenticated API user could exploit this by embedding carriage return and line feed characters to inject arbitrary email headers, enabling unauthorized email forwarding, reply redirection, and sender spoofing attacks. The vulnerability carries a CVSS score of 4.3 (Medium) with a network-based attack vector requiring low complexity and authenticated access. While the attack requires valid API credentials, it carries integrity impact through the ability to manipulate email routing and sender information. The fix, implemented in version 0.8.0, adds input validation at the schema level to reject any prohibited characters in affected fields, consistent with existing controls. There is no evidence of active exploitation in the wild, with an EPSS score of 0.00037 indicating minimal real-world prevalence. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and community attention remains low. Organizations running Plunk should prioritize upgrading to version 0.8.0 to prevent potential email-based social engineering and information disclosure attacks by authenticated users.