CVE-2026-90467 — aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. A…
Published: 2026-09-12 · CVSS: 6.3 · CVSS 4.0
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7