Prompt Injection in EmailGPT Enables System-Prompt Disclosure and Unwanted Prompt Execution

The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts. When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.

The advisory identifies the EmailGPT main branch as affected.

• The CNA record marks Git version 0 as affected through a specific upper commit boundary.
• The full commit identifier is not reproduced in this entry; deployments should be matched against the CNA record or repository history rather than assuming that every later commit is fixed.
• The product's default status is unknown.
• No fixed release or patch is confirmed.

EmailGPT provides an API service and Google Chrome extension intended to assist with email composition using GPT models. The weakness is classified as CWE-74 and occurs when attacker-controlled prompt content is processed with system instructions without sufficient separation or neutralization. An attacker can submit a direct prompt to take over the service logic, force the AI to disclose hard-coded system prompts, and/or make it execute unwanted prompts. The CNA description also confirms that a malicious prompt requesting harmful information can cause the system to provide the requested data. The service must be accessible to the attacker, but the implementation detail that allows the prompt to override system instructions and the exact authentication boundary are not disclosed.

Exploitation consists of submitting a malicious prompt to EmailGPT; the advisory does not describe a separate victim action that must occur after submission. Any individual with access to the service is identified as able to exploit the issue. The assessments in the record differ on access and privilege assumptions: one models adjacent-network access with low privileges, while another models network access without privileges, so the exact authentication requirement remains uncertain. The supplied record marks public_exploit as false, and the accompanying enrichment records exploitation as none at the time of assessment; this does not prove that exploitation has never occurred or will not occur.

The vulnerability can cause EmailGPT to disclose hard-coded system prompts and return data requested through a malicious prompt. An attacker may also cause unwanted prompt execution or take over the service logic, reducing confidence in the service's output. The advisory additionally warns of intellectual-property leakage, denial of service, and increased costs from repeated pay-per-use API requests. The record does not establish arbitrary code execution, compromise of the underlying host, or credential theft, so those outcomes remain unconfirmed.

The advisory identifies intellectual-property leakage, denial of service, and direct financial loss from repeated requests to a pay-per-use AI provider as potential consequences. Disclosure of system prompts can expose internal instructions or processing logic that the organization intended to protect. If the service processes business data in prompts or responses, prompt injection may increase the risk of data disclosure, but the record does not identify the specific data affected. The cost and service disruption will depend on the deployment model and the limits imposed by the AI provider.

1. Remove the EmailGPT applications from networks immediately, following the advisory's recommendation while no confirmed developer fix is available.
2. Do not return the service to production merely because it uses a newer commit or branch, since the record does not confirm a fixed release for later or parallel branches.
3. If immediate removal is not possible, isolate the service and restrict API access to the minimum required users. Treat this as temporary risk reduction, not as a vendor-confirmed fix.
4. Before restoration, obtain a maintainer-confirmed fix and compare the exact branch or commit against the complete affected boundary. Review request history and billing at the same time for system-prompt disclosure, unwanted requests, and unexpected usage costs.

Inventory the environment for EmailGPT API service and Google Chrome extension deployments, then identify copies from the main branch or Git boundary covered by the affected range. Review API requests and responses for prompts that request system-prompt disclosure, attempt to override system instructions, invoke unwanted prompt execution, or request harmful information. Compare service output with the configured standard system prompt to identify leakage of hard-coded instructions. Review AI-provider usage and billing records for unusual repeated requests, because the advisory identifies pay-per-use API requests as a potential source of financial loss. These are precautionary detection and monitoring measures; the absence of suspicious logs does not prove that the deployment is safe.