ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90467

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

CVSS 4.0 6.3 MEDIUMCVSS 3.1 4.0 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-90467

Published

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90467

Published

aiosmtplib

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "cole",
                    "product": "aiosmtplib",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/aiosmtplib",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "5.1.3"
                        },
                        {
                            "version": "5.1.3",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON