# CVE-2026-90467: aiosmtplib ESMTP command injection via email address validation

Source: https://junglewise.ai/threats/cve-2026-90467-aiosmtplib-esmtp-command-injection-via-email-address-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-12. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90467 · Severity: medium · CVSS 4 · Published 2026-09-12

aiosmtplib is an asynchronous SMTP client library used by Python applications to send emails. The library fails to properly validate email addresses, allowing attackers to inject SMTP protocol parameters (such as AUTH or NOTIFY) into mail commands. This could enable unauthorized sending of emails on behalf of authenticated users or forcing delivery notifications to unintended recipients.

## Quick answers

**Is CVE-2026-90467 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90467 being exploited in the wild.

**How severe is CVE-2026-90467?** Medium severity, with a CVSS score of 4, published 12 September 2026.

**Which products and versions are affected?** cole aiosmtplib before 5.1.3.

**Is there a fix for CVE-2026-90467?** A patch was published on 2026-09-12: Fixed in version 5.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90467 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90467?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw in aiosmtplib's email address validation, specifically in the MAIL FROM and RCPT TO SMTP command construction. Attackers can craft malicious email addresses containing spaces and angle brackets to append ESMTP parameters that modify the semantics of envelope commands. The root cause is insufficient validation in the parse_address and quote_address functions before email addresses are passed to SMTP commands. No authentication or special network access is required beyond the ability to supply a crafted email address to the SMTP client. An attacker can forge authenticated identities or force delivery notifications to third parties. The vulnerability was fixed in aiosmtplib version 5.1.3.

## Affected products

- cole aiosmtplib before 5.1.3

## Timeline

- 2026-09-12: disclosed
- 2026-09-12: patched: Fixed in version 5.1.3

## References

- [https://github.com/cole/aiosmtplib](https://github.com/cole/aiosmtplib)
- [https://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py](https://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py)