Authenticated Plunk API users can insert carriage return/line feed characters into fields such as from.name, subject, custom header keys/values, and attachment filenames when the system builds raw MIME messages. This unsanitized input permits the injection of arbitrary email headers, for example Bcc or Reply‑To, enabling silent forwarding of mail, redirection of replies, or spoofing of the sender. Such behavior enables covert communication or phishing attacks and undermines the authenticity and integrity of email traffic.

Plunk, an open‑source email platform built on AWS SES, is affected in versions prior to 0.8.0 where the SESService module lacks input validation. Versions 0.8.0 and later incorporate schema‑level checks that reject CRLF characters in the affected fields.

The CVSS score of 8.5 classifies the flaw as high severity. Attackers must possess authenticated API credentials to exploit it; no public exploit or default vulnerability exists. EPSS data is not available and the issue is not listed in the CISA KEV catalogue. The principal threat stems from compromised or malicious internal users who have API access, making the risk significant for organizations that grant such privileges.