CVE-2026-30227 MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery
Attackers can inject SMTP commands via CRLF in quoted email addresses, enabling email forgery or command execution in applications using MimeKit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30227?
CVE-2026-30227 is a medium-severity command injection vulnerability in jstedfast MimeKit, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as defined by numerous IETF specifications. Prior to version 4.15.1, a CRLF injection vulnerability in MimeKit allows an attacker to embed \r\n into the SMTP envelope address local-part (when the local-part is a quoted-string). This is non-compliant with RFC 5321 and can result in SMTP command injection (e.g., injecting additional RCPT TO / DATA / RSET commands) and/or mail header injection, depending on how the application uses MailKit/MimeKit to construct and send messages. The issue becomes exploitable when the attacker can influence a MailboxAddress (MAIL FROM / RCPT TO) value that is later serialized to an SMTP session. RFC 5321 explicitly defines the SMTP mailbox local-part grammar and does not permit CR (13) or LF (10) inside Quoted-string (qtextSMTP and quoted-pairSMTP ranges exclude control characters). SMTP commands are terminated by <CRLF>, making CRLF injection in command arguments particularly dangerous. This issue has been patched in version 4.15.1.
Weakness: CWE-93
Which versions are affected by CVE-2026-30227?
2 open source packages ship an affected version, including MimeKit. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
MimeKit NuGet | All versions | 4.15.1 |
MimeKit NuGet | All versions | 4.15.1 |
Products include Jstedfast Mimekit.
How do I fix CVE-2026-30227?
Upgrade MimeKit to 4.15.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-30227 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30227 exists.
Sources
Also known as GHSA-g7hc-96xr-gvvx.