Executive brief
aiosmtplib is an asynchronous SMTP client library used by Python applications to send emails. The library fails to properly validate email addresses, allowing attackers to inject SMTP protocol parameters (such as AUTH or NOTIFY) into mail commands. This could enable unauthorized sending of emails on behalf of authenticated users or forcing delivery notifications to unintended recipients.
Technical details
The vulnerability is a command injection flaw in aiosmtplib's email address validation, specifically in the MAIL FROM and RCPT TO SMTP command construction. Attackers can craft malicious email addresses containing spaces and angle brackets to append ESMTP parameters that modify the semantics of envelope commands. The root cause is insufficient validation in the parse_address and quote_address functions before email addresses are passed to SMTP commands. No authentication or special network access is required beyond the ability to supply a crafted email address to the SMTP client. An attacker can forge authenticated identities or force delivery notifications to third parties. The vulnerability was fixed in aiosmtplib version 5.1.3.
Affected products
- cole aiosmtplib before 5.1.3
Timeline
- 2026-09-12: disclosed
- 2026-09-12: patched: Fixed in version 5.1.3