What’s Vulnerable › Vulnerabilities

CVE-2026-90467: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

• Severity: medium (CVSS 4.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-12 · updated 2026-09-23
• Weakness: CWE-88

Description

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Affected products

• cole aiosmtplib: before 5.1.3 — fixed in 5.1.3

How to fix

Upgrade to a fixed version: cole aiosmtplib 5.1.3. Check the vendor advisory for mitigations.

References

• https://github.com/cole/aiosmtplib
• https://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py
• https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2
• https://github.com/cole/aiosmtplib/releases/tag/v5.1.3
• https://www.vulncheck.com/advisories/aiosmtplib-before-5.1.3-esmtp-parameter-injection-via-unvalidated-addresses

Get alerted when CVE-2026-90467 or the next vulnerability affects your stack