One scenario I can imagine is a regex which doesn't properly handle multi-line inputs (quite common issue in ruby[1]). Together with a mail header injection vul

One scenario I can imagine is a regex which doesn't properly handle multi-line inputs (quite common issue in ruby[1]). Together with a mail header injection vulnerability, this input could be dangerous: user@real.com\nCc:attacker@evil.com [1]: http://guides.rubyonrails.org/security.html#regular-expressions http://guides.rubyonrails.org/security.html#regular-expressi...