Skip to content
OpenAdvisories

Weakness (CWE)

CWE-93: Improper Neutralization of CRLF Sequences

Base Draft

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

How to prevent it (2 mitigations)

  1. Implementation

    Avoid using CRLF as a special sequence.

  2. Implementation

    Appropriately filter or quote CRLF sequences in user-controlled input.

Source: MITRE CWE-93

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-113386 Public exploit

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated a…

    Roundcube Webmail roundcube roundcube Debian Ubuntu
  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.6
    CVE-2026-39983 Public exploit

    FTP Command Injection via CRLF in basic-ftp

    basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir…

    patrickjuchli basic-ftp basic-ftp node-proxy-agents Debian Ubuntu npm
  • High 8.8
    CVE-2026-35517 Public exploit

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

    FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter …

    pi-hole FTL
  • High 8.5
    CVE-2026-34975 Public exploit

    Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header injection vulnerability was discovered in SESService.ts, where user-supplied values for from.name, subject, custom header keys/values, and attachment filenames were …

    useplunk plunk
  • High 7.5
    CVE-2026-22777 Public exploit

    ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

    ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead …

    Comfy-Org ComfyUI-Manager comfy-cli PyPI
  • High 7.5
    CVE-2025-61884 Exploited · Ransomware Public exploit EPSS 96%

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions…

    Oracle Oracle Configurator
    KEV Oct 20, 2025
  • High 8.8
    CVE-2021-39172 Public exploit EPSS 29%

    New line injection during configuration edition

    Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execut…

    fiveai Cachet cachethq/cachet Packagist