CVE-2026-53533: cole aiosmtplib SMTP command injection in sender and recipient addresses

Executive brief

aiosmtplib is a Python library used by applications to send emails asynchronously. A vulnerability exists where an attacker can inject malicious commands into email sender or recipient fields. This could allow an attacker to send unauthorized emails or cause the application to stop responding, potentially disrupting communication services.

Technical details

The aiosmtplib library fails to properly neutralize CR/LF (\r\n) sequences in arguments passed to SMTP methods including mail(), rcpt(), vrfy(), and expn(). When these methods receive an address containing CR/LF, the library writes the sequence verbatim to the SMTP control connection, allowing an attacker to 'smuggle' additional SMTP commands (such as DATA or AUTH) that the server will execute as standalone instructions. This can lead to the desynchronization of the command/response pipeline, causing the client to hang (DoS) or allowing the delivery of unauthorized messages. The vulnerability is present in version 5.1.0 and earlier; it is fixed in version 5.1.1.

Affected products

• cole aiosmtplib <= 5.1.0

Timeline

• 2026-05-31: disclosed
• 2026-07-07: advisory: GitHub Advisory published
• 2026-07-07: patched: Version 5.1.1 released

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D