CVE-2026-34975 useplunk CVE debrief

Who should care

Defenders responsible for email platforms, security teams, and developers using the Plunk platform should assess exposure and apply the fix to prevent potential email header injection and sensitive content manipulation.

Why it matters

CVE-2026-34975 is a high-severity vulnerability in Plunk, an open-source email platform, allowing an authenticated API user to inject arbitrary email headers and potentially manipulate sensitive email content.

• Potential email header injection and sensitive content manipulation.
• Silent email forwarding and reply redirection.
• Sender spoofing and email content tampering.

Technical summary

The vulnerability is caused by the lack of input validation and sanitization in SESService.ts, allowing an authenticated API user to inject arbitrary email headers by embedding carriage return/line feed characters in user-supplied values for from.name, subject, custom header keys/values, and attachment filenames. This could enable silent email forwarding, reply redirection, or sender spoofing. The fix adds input validation at the schema level to reject any of these fields containing or characters, consistent with the existing validation already applied to the contentId field.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability allows for potential email header injection and sensitive email content manipulation.

Recommended defensive actions

• Verify exposure by checking if the Plunk platform is in use and if the version is prior to 0.8.0.
• Apply the fix by upgrading to Plunk version 0.8.0 or later.
• Monitor email content and headers for potential anomalies.
• Review and update input validation and sanitization for user-supplied values.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was discovered in SESService.ts, where user-supplied values for from.name, subject, custom header keys/values, and attachment filenames were interpolated directly into raw MIME messages without sanitization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.