Description

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-21T18:17:16.137Z",
  "pubdate": "2026-09-21T18:17:16.137Z",
  "executiveSummary": "The Email::Sender::Transport::Sendmail module, specifically versions prior to 2.602, contains a critical OS command injection vulnerability when executing on the MSWin32 platform.\nThe vulnerability arises from the insecure handling of envelope sender and recipient addresses within the _sendmail_pipe function, which utilizes the open() function to pass command strings directly to the system shell.\nAn attacker capable of influencing the 'From', 'To', or 'Cc' headers in an email—often processed by Email::Sender::Simple—can inject arbitrary shell commands.\nThe execution of these commands occurs with the privileges of the process running the application, leading to potential Remote Code Execution (RCE).\nThis flaw is specific to Windows environments, as other platforms correctly invoke the sendmail binary using the list-form of open(), which bypasses the shell interpreter.\nSuccessful exploitation requires the application to process attacker-controlled email headers and execute the transport mechanism on a Windows host, posing a severe risk to system integrity and data confidentiality.",
  "technicalDetails": "The root cause of this vulnerability lies in the platform-specific implementation of the _sendmail_pipe function within Email::Sender::Transport::Sendmail. On the MSWin32 platform, the module concatenates envelope sender and recipient addresses into a single command string that is subsequently passed to the system shell via Perl's open() function.\nUnlike Unix-like systems, where the list form of open() is utilized to bypass shell interpolation by executing the binary directly, the Windows implementation relies on the shell to interpret the command string. This behavior exposes the system to command injection when metadata extracted from email headers is treated as part of the shell execution chain.\nThe attack flow begins when Email::Sender::Simple is used to dispatch mail. If the caller does not explicitly provide an envelope, the library automatically populates the sender and recipient addresses by parsing the 'From', 'To', and 'Cc' headers. An attacker who can influence the contents of these headers can inject shell metacharacters (such as '&', '|', or ';') into the address strings.\nWhen _sendmail_pipe constructs the command line, these injected characters are interpreted by the Windows shell, allowing for the execution of arbitrary commands. For example, by providing a malformed email address containing shell-specific operators, an attacker can terminate the intended command and append malicious payloads. The command is then executed in the context of the user or service process that triggered the email transmission.\nBecause the payload is executed directly by the shell, the attacker gains the ability to perform any action permitted by the application's service account, including file system modification, data exfiltration, or the installation of persistent malicious code. There is no requirement for prior authentication to the module itself; the vulnerability is triggered automatically as part of the standard message handling pipeline, provided the attacker-controlled input is passed to the transport layer without proper sanitization.\nThis vulnerability is confined to MSWin32 environments, as other platforms utilize a safer execution pattern that does not involve the shell for command construction, thereby neutralizing the primary attack vector."
}