The vulnerability allows an attacker to inject carriage‑return and line‑feed characters into MIME attachment filenames that are inserted into the Content-Type and Content-Disposition headers. Because the library does not strip CR/LF characters, a filename containing such characters expands into additional, attacker‑controlled header lines when the message is serialized. This can create forged email headers such as Bcc, CC or other control headers, enabling unintended email distribution or altering message semantics.

zbateson mail-mime-parser, versions prior to 3.0.6 and 4.0.2, including the obsolete 1.x and 2.x lines. Versions 3.0.6 and 4.0.2 contain the fix and are no longer affected.

With a CVSS score of 7.2 the vulnerability is considered high severity. No EPSS data is available and it is not listed in the KEV catalog. The flaw is exploitable when an application that uses this parser receives or processes untrusted mail with malicious attachment filenames, then re‑attaches or forwards the message. The attack requires the application to be exposed to such mail; client‑side exploitation is therefore limited to services that parse inbound mail. Successful exploitation allows an attacker to add arbitrary headers, potentially causing sensitive mail to be sent to unintended recipients or altering message metadata.