CVE-2026-90467: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using aiosmtplib before 5.1.3 are exposed when untrusted parties can influence the email addresses passed by the application as envelope sender or recipient values.
What must an attacker control to exploit it?
An attacker needs to supply a crafted email address containing spaces and angle brackets. This can append ESMTP parameters to MAIL FROM or RCPT TO command lines.
What is the recommended remediation?
Upgrade aiosmtplib to version 5.1.3 or later. The affected versions are those before 5.1.3.
What can be done if upgrading is not immediately possible?
Ensure that caller-supplied envelope addresses are validated before being passed to aiosmtplib, rejecting values that contain spaces or angle brackets capable of adding SMTP command parameters.
How can an organization investigate possible exploitation?
Review application inputs and SMTP transaction logs for MAIL FROM or RCPT TO commands containing unexpected parameters such as AUTH, NOTIFY, or ORCPT, especially where those values originated from user-controlled address fields.