Command Injection Vulnerability in aiosmtplib SMTP Client
CVE-2026-53533
6.9MEDIUM
What is CVE-2026-53533?
The aiosmtplib SMTP client before version 5.1.1 contains a command injection vulnerability due to its handling of caller-supplied email addresses. Specifically, functions like SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() do not adequately reject embedded CR or LF bytes. This oversight allows for the injection of additional SMTP commands, including MAIL FROM and RCPT TO, through manipulated envelope sender or recipient details. Consequently, attackers could desynchronize the command-response pipeline, hang the SMTP instance, or dispatch arbitrary messages, all without controlling the SMTP server. This vulnerability has been resolved in version 5.1.1.
Affected Version(s)
aiosmtplib < 5.1.1