Description

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-09-12T02:16:24.770Z",
  "pubdate": "2026-09-12T02:16:24.770Z",
  "executiveSummary": "The aiosmtplib library, prior to version 5.1.3, is susceptible to an ESMTP parameter injection vulnerability resulting from insufficient input validation of email addresses.\nThis vulnerability allows an attacker to inject arbitrary ESMTP parameters into the MAIL FROM and RCPT TO command lines during the SMTP transaction phase.\nThe primary risk involves the forgery of authenticated identities and the potential for unauthorized delivery notifications, potentially leading to administrative bypass or social engineering.\nThe attack is viable when an attacker has the ability to provide input to the library's email addressing functions, which are subsequently processed without proper sanitization.\nBy manipulating the address string to include control characters, such as spaces and angle brackets, an attacker can prematurely terminate the address field and append malicious ESMTP extensions like AUTH, NOTIFY, or ORCPT.\nThis flaw impacts all applications utilizing affected versions of aiosmtplib to construct SMTP envelopes.\nSuccessful exploitation requires no prior authentication to the target SMTP server, as the injection occurs within the client-side library before the commands reach the mail transfer agent.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization of email address inputs provided by the caller to the aiosmtplib library. Specifically, the library fails to validate that the input strings provided for MAIL FROM and RCPT TO addresses are strictly formatted according to RFC 5321 and RFC 5322 standards.\nIn standard SMTP communications, the MAIL FROM and RCPT TO commands expect an address enclosed in angle brackets. The server considers the command complete once the final bracket is processed. If an attacker injects whitespace followed by additional parameters into these fields, the lack of filtering allows these extra parameters to be treated as part of the command line rather than part of the email address itself.\nThe attack flow follows a predictable sequence: First, the attacker identifies an application interface that accepts an email address and transmits it using an affected version of aiosmtplib. Second, the attacker crafts a malicious string, such as 'victim@example.com> NOTIFY=SUCCESS,FAILURE'. When this string is passed to the library, the library does not strip the trailing characters.\nDuring the SMTP handshake, aiosmtplib sends the following command to the remote server: 'MAIL FROM:<victim@example.com> NOTIFY=SUCCESS,FAILURE'. The receiving mail server, which may support ESMTP extensions, parses the injected 'NOTIFY' parameter as a valid extension request for the transaction.\nThe impact of this injection is significant. By appending the 'AUTH' parameter, an attacker can attempt to perform identity spoofing, potentially tricking receiving servers into associating the message with a specific authorized identity. By injecting the 'NOTIFY' or 'ORCPT' parameters, an attacker can force the mail server to send delivery status notifications (DSNs) to unauthorized third-party addresses, effectively leveraging the target infrastructure for mail amplification or reconnaissance.\nBecause the library performs this construction internally, the resulting injection is transparent to the developer using the library, making it difficult to detect through application-level logging alone. The vulnerability remains effective against any mail server that adheres to modern ESMTP specifications and processes the injected extensions, regardless of whether the attacker has valid credentials on the target system."
}