VDB
CVE-2026-90467
CVE-2026-90467
PUBLISHED
CVSS 6.3 MEDIUM
Reported by VulnCheck · Published September 12, 2026
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
Risk Scores
CVSS 4.0
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cole | aiosmtplib | 0, 5.1.3 |
| cole | aiosmtplib | 0, 5.1.3, 0 |
Timeline
- Sep 12, 2026 EPSS Score
- Sep 12, 2026 CVE Published
- Sep 14, 2026 CVE Updated
- Sep 17, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
References
- Patch Commit patch
- aiosmtplib v5.1.3 Release Notes release-notes
- Unvalidated quote_address() in v5.1.2 technical-description
- product
- VulnCheck Advisory: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses third-party-advisory