CVE-2026-90467 in aiosmtplib
Summary
by MITRE • 09/12/2026
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in aiosmtplib versions prior to 5.1.3 represents a critical input validation failure within the Simple Mail Transfer Protocol client implementation. This flaw stems from insufficient sanitization of email address strings provided by application callers before they are embedded into SMTP envelope commands, specifically the MAIL FROM and RCPT TO directives. In standard SMTP operations, these commands define the sender and recipient addresses for an email transaction. However, because aiosmtplib did not strictly enforce format constraints on user-supplied input, it allowed special characters such as spaces and angle brackets to pass through without proper escaping or rejection. This lack of rigorous validation creates a pathway for command injection attacks where malicious actors can manipulate the structure of SMTP commands by appending additional parameters that are normally reserved for system-level configuration rather than end-user address fields.
The technical mechanism of this exploitation relies on the flexibility of the ESMTP protocol, which allows optional extensions to be specified within the MAIL FROM and RCPT TO lines using angle brackets and parameter keywords. By crafting a malicious email address containing spaces followed by parameters such as AUTH for authentication injection, NOTIFY for delivery status notification manipulation, or ORCPT for original recipient tracking, an attacker can effectively alter the behavior of the mail server receiving these commands. For instance, injecting an AUTH parameter might allow an attacker to impersonate a different authenticated identity if the server processes it incorrectly, while injecting NOTIFY parameters could force the generation and sending of delivery receipts to third-party addresses controlled by the attacker. This capability undermines the integrity of email communications and can be leveraged for phishing campaigns, reputation damage, or further network reconnaissance through error-based information leakage.
From an operational impact perspective, this vulnerability poses significant risks to organizations relying on aiosmtplib for automated email sending workflows. The ability to forge authenticated identities compromises non-repudiation guarantees essential in many business communications and regulatory compliance frameworks. Furthermore, the potential to redirect delivery notifications can lead to privacy violations or enable attackers to confirm valid email addresses through bounce analysis techniques. In environments where sensitive data is transmitted via email, such manipulation could also facilitate social engineering attacks by making malicious emails appear more legitimate or altering their routing paths to bypass security controls that rely on sender verification. The severity of this issue is compounded by the fact that it affects a widely used asynchronous SMTP library in Python ecosystems, potentially impacting numerous applications and services without immediate visibility into the underlying protocol manipulation occurring at the application layer.
To mitigate these risks, organizations must immediately upgrade aiosmtplib to version 5.1.3 or later, where proper input validation has been implemented to reject addresses containing invalid characters or unauthorized parameters in envelope commands. Developers should also implement defense-in-depth strategies by validating email formats using robust regular expressions that strictly adhere to RFC standards before passing them to the library. Additionally, integrating SMTP authentication checks and monitoring for anomalous command patterns can help detect attempted exploitation in real-time. It is crucial to review all code paths where user-supplied data interacts with mail sending functions to ensure no other instances of this vulnerability exist within custom implementations or wrappers around the library.
This vulnerability aligns with CWE-74, which describes injection flaws resulting from the improper neutralization of special elements used in commands, and specifically relates to CWE-20 Improper Input Validation where inputs are not adequately checked for type, length, domain, range, format, or consistency. In terms of offensive security frameworks, this technique corresponds to ATT&CK T1568.002 Dynamic Resolution which involves manipulating DNS or protocol parameters, although in this context it is more accurately mapped to command injection vectors within application protocols similar to CWE-77 Command Injection. The exploitation method reflects a classic pattern where trusted software components are tricked into executing unintended commands due to insufficient separation between data and control structures within the SMTP envelope syntax.