Phishing email injection via whitespace bypass

Email injection in Lunary before 1.4.10 allows remote attackers to place attacker-controlled content in verification emails. The send-verification and signup handlers derive a first name with extractFirstName, whose ordinary-whitespace parsing can be bypassed with a nonbreaking space so injected content reaches the email body. No authentication is required; a recipient must act on the crafted message for phishing consequences, while the direct effect is unauthorized content in mail sent by the application.