CVE-2026-90467
MediumCVSS 4.0Summary
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Risk Assessment
An attacker could forge an authenticated identity or force delivery notifications to unintended recipients, potentially leading to phishing and reputational damage. The risk affects applications sending mail via aiosmtplib with user-supplied input.
Recommendation
Upgrade aiosmtplib to version 5.1.3 or later. Until patched, strictly validate and sanitize email addresses passed to the library.
Other vulnerabilities in aiosmtplib
See all- CVE-2026-55558Medium
aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol._buffer. An active network attacker can place attacker-chosen SMTP response lines after the plaintext 220 response in the same network segment. The method then calls loop.start_tls; those bytes survive the transport upgrade and are parsed as the first response from inside the TLS session, desynchronizing subsequent SMTP command and response pairs. Connections using start_tls=True or opportunistic STARTTLS are affected, while connections using use_tls=True are not. This issue is fixed in version 5.1.2.
- CVE-2026-53533Medium
aiosmtplib before 5.1.1 does not reject addresses containing CR or LF bytes in SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn(). Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server.
Original NVD description (English source)
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.