plunk
v0.18.0The Open-Source Email Platform
- Maintenance
- Active144 commits in 3 months · bus factor 1
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 11 advisories2 critical, 6 high, 3 medium
- Supported versions
- No scheduleendoflife.date does not track this project
5.6k stars · 439 forks · 57 open issues · last release 14 days ago · data checked 49 minutes ago
Security advisories
All advisories on GitHubThe 11 most recent advisories published by the maintainers: 2 critical, 6 high, 3 medium. Check the patched version against the one you run.
- highGHSA-v958-vf5v-cxjrNov 11, 2026Cross-tenant workflow trigger via unsanitized contactId in POST /events/track
- Affected
- < 0.13.0
- Patched in
- 0.13.0
- highGHSA-xmqh-qfqq-4883Nov 11, 2026SSRF Guard Bypass via IPv6 Transition Addresses in Webhook Execution Service
- Affected
- < 0.13.0
- Patched in
- 0.13.0
- highGHSA-mwh5-6jhc-j52cNov 11, 2026SNS webhook accepts messages from topics outside the installation's AWS account
- Affected
- <= 0.17.0
- Patched in
- 0.18.0
- highGHSA-9g9f-4cpj-p2jvNov 11, 2026Cross-site request forgery on dashboard account routes allows project reset and API key regeneration
- Affected
- < 0.18.0
- Patched in
- 0.18.0
- highGHSA-2972-cw4f-hj5rOct 13, 2026Event data keys from the public tracking endpoint are compiled as regular expressions, letting anonymous visitors stall or hang the API in Plunk
- Affected
- <=0.15.0
- Patched in
- 0.16.0
- criticalCVE-2026-42193Apr 20, 2026SNS webhook forgery
- Affected
- < 0.8.0
- Patched in
- 0.9.0
- mediumCVE-2026-42192Apr 20, 2026Stored XSS in campaign view
- Affected
- <0.8.0
- Patched in
- 0.9.0
- highCVE-2026-34975Mar 31, 2026CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers
- Affected
- <= 0.7.1
- Patched in
- 0.8.0
- mediumCVE-2026-32095Mar 10, 2026Stored Cross-Site Scripting (XSS) via SVG File Upload
- Affected
- <= 0.7.0
- Patched in
- 0.7.1
- criticalCVE-2026-32096Mar 5, 2026SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns
- Affected
- <= 0.6.0
- Patched in
- 0.7.0
- mediumGHSA-w4xp-395x-725jFeb 19, 2026Cross-project information disclosure via job status endpoints (IDOR)
- Affected
- <= 0.5.0
- Patched in
- >= 0.6.0