Crafting Emails with HTML Injection

This report describes how unencoded user input in HTML-enabled emails and certain request headers (e.g., X-Forwarded-For, Host) can be abused to inject HTML into outbound emails, hide or replace legitimate content, and craft malicious links—potentially leading to phishing and password-reset token leakage to attacker-controlled domains. It provides concrete examples, detection tips (viewing raw email source, base64 decoding), and remediation guidance such as output-encoding and disabling HTML email bodies.