What’s Vulnerable › Vulnerabilities

CVE-2020-28247

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-12 · updated 2026-06-17

Description

The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.

Affected products

• lettre: from 0.8.0 through 0.8.3; from 0.9.0 through 0.9.5; 0.7.0, 0.10.0-alpha1, 0.10.0-alpha2, 0.10.0-alpha3

References

• https://github.com/RustSec/advisory-db/pull/478/files
• https://github.com/lettre/lettre
• https://rustsec.org/advisories/RUSTSEC-2020-0069.html
• https://github.com/RustSec/advisory-db/pull/478/files
• https://github.com/lettre/lettre
• https://rustsec.org/advisories/RUSTSEC-2020-0069.html

Get alerted when CVE-2020-28247 or the next vulnerability affects your stack