CVE-2026-90467
aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
CVSS 4.0 6.3 MEDIUMCVSS 3.1 4.0 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-90467
Publishedaiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90467 · CVE overview and exploitation status
cve-program · CVE-2026-90467
- https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2
- https://github.com/cole/aiosmtplib/releases/tag/v5.1.3
- https://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py
- https://github.com/cole/aiosmtplib
- https://www.vulncheck.com/advisories/aiosmtplib-before-5.1.3-esmtp-parameter-injection-via-unvalidated-addresses
Related changes
Linked by CVE identifierNo related changes are available here.