Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90467aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

Medium 4.0

In plain English

A medium-severity argument injection in aiosmtplib from cole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	aiosmtplib	no fix listed	DEBIAN-CVE-2026-90467
Debian:13	aiosmtplib	no fix listed	DEBIAN-CVE-2026-90467
Debian:14	aiosmtplib	5.1.3-1	DEBIAN-CVE-2026-90467
Ubuntu:22.04:LTS	aiosmtplib	no fix listed	UBUNTU-CVE-2026-90467
Ubuntu:26.04:LTS	aiosmtplib	no fix listed	UBUNTU-CVE-2026-90467
Ubuntu:26.10	aiosmtplib	no fix listed	UBUNTU-CVE-2026-90467

Affected products (as reported)

Vendor	Product	Versions
cole	aiosmtplib	0 – before 5.1.3

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

Patch Commit patch
aiosmtplib v5.1.3 Release Notes release-notes
Unvalidated quote_address() in v5.1.2 technical-description
https://github.com/cole/aiosmtplib product
VulnCheck Advisory: aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses third-party-advisory