CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe.
On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header.
An attacker who controls one of those header addresses runs commands as the sending process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Email::Sender::Transport::Sendmail / Email-Senderto a version that resolves this vulnerability.Fixed in 2.602
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects Email::Sender::Transport::Sendmail versions before 2.602 when running on Windows (MSWin32). Other platforms use the list form of open() to invoke sendmail directly and are not described as affected.
What attacker-controlled input is required for exploitation?
An attacker needs control of an envelope sender or recipient address that reaches _sendmail_pipe. If the caller does not provide an envelope, addresses from the From, To, and Cc headers are used, so control of one of those header addresses is sufficient.
What privileges would successful command execution have?
Commands run with the privileges of the process sending the email.
What can be done if an upgrade is not immediately possible?
Avoid allowing untrusted parties to control envelope addresses or the From, To, and Cc headers used to derive the envelope. Supplying and validating envelope sender and recipient addresses separately prevents reliance on untrusted message headers for those values.