# Email Header Injection

> Detects email sending functions that include user input in email headers without CRLF stripping, enabling spam relay and header manipulation.

- Skill: `zakirkun/email-header-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/email-header-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/email-header-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/email-header-injection

---


# Email Header Injection

## Overview
Email header injection (also known as SMTP header injection) allows attackers to inject additional `To:`, `CC:`, `BCC:` headers or modify the message by inserting CRLF sequences (`\r\n`) into email fields. This turns the application into a spam relay.

Attack: Setting the "From name" to `victim@example.com\r\nBCC: spam@list.com` adds a blind carbon copy to all sent emails.

## Remediation
- Strip `\r`, `\n` from all user-supplied email header values
- Use email library functions that automatically prevent injection
- Never concatenate user input directly into SMTP headers