AIKIDO-2026-11075

TL;DR

The Message mail class in Laravel does not reject email address strings containing carriage return or line feed characters before forwarding them to the Symfony Mailer transport. An attacker who controls an address used by the application can inject additional headers such as Bcc to redirect outbound mail to unintended recipients or abuse the host to relay attacker-controlled email. The fix adds an ensureAddressIsSafe check that throws an InvalidArgumentException for any address containing \r or \n.