EUVD-2026-61138
GHSA-v3q9-hj7j-63hq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker submits input over network with no authentication required; scope changes because injected commands execute against the SMTP server as a separate component; no confidentiality impact identified in advisory.
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (https://github.com/cole/aiosmtplib).
CVSS VectorVendor: https://github.com/cole/aiosmtplib
Lifecycle Timeline
2DescriptionCVE.org
Summary
aiosmtplib's SMTP.mail(), SMTP.rcpt(), SMTP.vrfy() and SMTP.expn() send the caller-supplied email address to the server without rejecting embedded CR/LF (\r\n) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more additional, standalone SMTP command lines. A caller that passes an attacker-influenced sender or recipient address into mail()/rcpt() (or vrfy()/expn()) therefore allows SMTP command injection (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH into the session. Injected commands will cause the SMTP instance to hang, but all commands required to complete the envelope could be sent in one address string.
The SMTP.sendmail() command will pass sender and recipient addresses verbatim through to SMTP.mail() & SMTP.rcpt(), and so is also vulnerable. SMTP.send_message() is not affected.
Impact
Severity: medium. Type: SMTP protocol command injection (CWE-93 - Improper Neutralization of CRLF Sequences; CWE-77 - Command Injection).
When an application built on aiosmtplib derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to mail()/rcpt() (directly, or via sendmail()/send() without a Message object), the attacker can:
- desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service
- inject multiple commands in one address to send an arbitrary message
The address only needs to reach mail()/rcpt()/vrfy()/expn(); no attacker control over the SMTP server is required.
Vulnerable versions
Affected version: aiosmtplib 5.1.0 (latest at time of report) and all earlier releases.
Credit
Reported by tonghuaroot.
AnalysisAI
SMTP command injection in aiosmtplib (all versions through 5.1.0) enables any attacker who can influence email addresses passed to SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), SMTP.expn(), or the higher-level SMTP.sendmail() to inject arbitrary SMTP protocol commands by embedding CR/LF bytes in the address string. Applications that accept sender or recipient addresses from untrusted input - web forms, APIs - and forward them to these methods without CR/LF sanitization are at risk of session desynchronization, client-side denial of service via SMTP client hang, or delivery of attacker-crafted email through the victim application's SMTP connection. No vendor-released patch version is confirmed from available data at time of analysis, and no public exploit has been identified.
Technical ContextAI
aiosmtplib (CPE: pkg:pip/aiosmtplib) is a Python asyncio-based SMTP client library. The root cause maps to CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-77 (Improper Neutralization of Special Elements used in a Command). The SMTP protocol delimits commands with CRLF (\r\n); any data written to the TCP control connection that contains a CRLF sequence is parsed by the receiving SMTP server as the end of one command and the start of another. The vulnerable methods - SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() - write caller-supplied email address strings verbatim to the connection without stripping or rejecting embedded \r or \n bytes. SMTP.sendmail() and SMTP.send() (when not given a Message object) funnel addresses through these same code paths and are therefore transitively vulnerable. SMTP.send_message(), which constructs the envelope internally from a structured email.message.Message object, is explicitly stated as unaffected, indicating that method performs envelope extraction from a structured object rather than forwarding raw strings.
RemediationAI
No vendor-released patched version of aiosmtplib has been confirmed from available data; monitor the GitHub Advisory GHSA-v3q9-hj7j-63hq (https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq) and the upstream repository at https://github.com/cole/aiosmtplib for patch releases and upgrade as soon as one is available. The most effective immediate architectural workaround is to migrate all email-sending code to SMTP.send_message() with a properly constructed email.message.Message object, as this code path is explicitly unaffected - note that this requires refactoring call sites that currently pass raw address strings. As a compensating control where refactoring is not immediately feasible, validate all caller-supplied email addresses at the application ingress boundary to reject any string containing \r (CR) or \n (LF) characters before they reach any aiosmtplib method; Python's email.utils.parseaddr() can normalize addresses, after which a simple membership check for \r or \n in the normalized local-part and domain is sufficient. Input validation should be enforced at the web form or API boundary rather than relying on future library-level sanitization.
Same weakness CWE-77 – Command Injection
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today