Email::Sender::Transport::Sendmail up to 2.601 Sendmail Pipe Sendmail.pm _sendmail_pipe envelope_address os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in Email::Sender::Transport::Sendmail up to 2.601. This impacts the function _sendmail_pipe of the file Sendmail.pm of the component Sendmail Pipe. The manipulation of the argument envelope_address results in os command injection. This vulnerability is identified as CVE-2026-93012. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Email::Sender::Transport::Sendmail up to 2.601. Affected is the function _sendmail_pipe of the file Sendmail.pm of the component Sendmail Pipe. The manipulation of the argument envelope_address with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-93012 since 09/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

Upgrading to version 2.602 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-84006). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Mail Server Software

Name

• Email::Sender::Transport::Sendmail

Version

• 2.601

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion