CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
Attackers can inject ESMTP parameters into email commands via malicious addresses, forging identities or forcing notifications in aiosmtplib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90467?
CVE-2026-90467 is a medium-severity vulnerability in cole aiosmtplib, published on 12 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Weakness: CWE-88
Which versions are affected by CVE-2026-90467?
Linux distribution packages (1)
python-aiosmtplib openSUSE:Tumbleweed | All versions | 5.1.3-1.1 |
How do I fix CVE-2026-90467?
Upgrade to a fixed version.
Is CVE-2026-90467 being exploited?
There is no known exploitation of CVE-2026-90467 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FC13167, DEBIAN-CVE-2026-90467, GHSA-qh75-x5jv-g7wg, UBUNTU-CVE-2026-90467, openSUSE-SU-2026:11799-1.