CVE-2026-90467
aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
CVSS Score
4.0
EPSS Score
0.0%
EPSS Percentile
0th
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
| CWE | CWE-88 |
| Vendor | cole |
| Product | aiosmtplib |
| Published | Sep 12, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for cole aiosmtplib
Be the first to know when new medium vulnerabilities affecting cole aiosmtplib are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
cole / aiosmtplib
0 < 5.1.3
References
github.com: https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2 github.com: https://github.com/cole/aiosmtplib/releases/tag/v5.1.3 github.com: https://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py github.com: https://github.com/cole/aiosmtplib vulncheck.com: https://www.vulncheck.com/advisories/aiosmtplib-before-5.1.3-esmtp-parameter-injection-via-unvalidated-addresses
Credits
Alfie Goh Li Heng