THREAT OPS › Threat News › [NVD] CVE-2026-90467 (MEDIUM 4.0) — aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like A
[NVD] CVE-2026-90467 (MEDIUM 4.0) — aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like A
CVE-2026-90467 CVSS: 4.0 MEDIUM Published: 2026-09-12T02:16:24.770
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging
MITRE ATT&CK techniques
- Email AddressesT1589.002
Indicators of compromise
- CVE-2026-90467cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90467