cole aiosmtplib up to 5.1.0 Address SMTP.mail/SMTP.rcpt/SMTP.vrfy/SMTP.expn command injection

Summaryinfo

A vulnerability labeled as critical has been found in cole aiosmtplib up to 5.1.0. This impacts the function SMTP.mail/SMTP.rcpt/SMTP.vrfy/SMTP.expn of the component Address Handler. The manipulation results in command injection. This vulnerability is cataloged as CVE-2026-53533. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in cole aiosmtplib up to 5.1.0. It has been classified as critical. Affected is the function SMTP.mail/SMTP.rcpt/SMTP.vrfy/SMTP.expn of the component Address Handler. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on integrity, and availability. CVE summarizes:

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR or LF bytes. Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker who influences an envelope sender or recipient to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server. This issue is fixed in version 5.1.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-53533 since 06/09/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 5.1.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• cole

Name

• aiosmtplib

Version

• 5.0
• 5.1.0

Website

• Product: https://github.com/cole/aiosmtplib/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion