CVE-2026-90467

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90467
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90467.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90467
Downstream
Published
2026-09-12T01:50:34Z
Modified
2026-09-13T03:46:11Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
Details

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90467.json"
}
References

Affected packages

Git / github.com/cole/aiosmtplib

Affected ranges

Type
GIT
Repo
https://github.com/cole/aiosmtplib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9cc425460026ee54392507f0593ecd4052cd6aa4
Fixed
2e1b210714974ccc9efd0d09a8f846cb9aeaaec2
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.1.3"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.1.0
v1.1.0b0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.5.dev0
v1.1.6
v1.1.7
v2.*
v2.0.0
v2.0.0.post0
v2.0.0b0
v2.0.0b1
v2.0.1
v3.*
v3.0.0
v3.0.1
v3.0.2
v4.*
v4.0.0
v4.0.1
v4.0.2
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90467.json"