SuperPlane before version 0.30.0 allows unauthenticated attackers to insert arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. The unsanitized title is passed directly to the SMTP DATA command, which enables attackers to add headers such as Bcc for exfiltration, forge the From address to bypass SPF/DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies, facilitating phishing.

The vulnerability affects the SuperPlane product from superplanehq. All installations running any version of SuperPlane older than 0.30.0 are susceptible to this exploit. The weakness is triggered through the webhook event title field.

The EPSS score of less than 1% indicates a low but non-zero likelihood of exploitation in the wild. The CVSS score of 6.3 reflects medium severity. SuperPlane is not listed in the CISA KEV catalog. Attackers can exploit this via unauthenticated access to the webhook endpoint, inserting CRLF sequences in the title to inject malicious SMTP headers. No additional prerequisites beyond the ability to send webhook requests are required.