CVE-2026-53533: aiosmtplib SMTP Command Injection RCE Flaw

CVE-2026-53533 Overview

CVE-2026-53533 is a command injection vulnerability in aiosmtplib, an asynchronous Simple Mail Transfer Protocol (SMTP) client for Python's asyncio framework. Versions prior to 5.1.1 fail to reject Carriage Return (CR) or Line Feed (LF) bytes in caller-supplied email addresses. An attacker who controls an envelope sender or recipient can inject additional SMTP command lines such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. The flaw affects SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), SMTP.expn(), SMTP.sendmail(), and SMTP.send() when called without a Message object. SMTP.send_message() is unaffected. The issue is fixed in version 5.1.1.

Critical Impact
Attackers who influence envelope addresses can inject arbitrary SMTP commands, desynchronize the command-response pipeline, hang the client, or send unauthorized messages without compromising the SMTP server.

Affected Products

aiosmtplib versions prior to 5.1.1
Python applications using SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), or SMTP.expn() with untrusted input
Python applications using SMTP.sendmail() or SMTP.send() without a Message object

Discovery Timeline

2026-08-18 - CVE-2026-53533 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53533

Vulnerability Analysis

The SMTP protocol frames commands using CRLF line terminators. When aiosmtplib writes a caller-supplied address directly into a command line, any embedded CR or LF byte terminates the current command. Bytes following the line break are interpreted by the SMTP server as a new standalone command.

This primitive gives the attacker the ability to append arbitrary SMTP verbs to the connection stream. Injected commands execute in the authenticated session context of the client. Possible outcomes include silently rerouting mail, adding recipients, resetting transaction state, or forcing the client into a hung state as the command-response pipeline desynchronizes.

The issue is classified as Command Injection [CWE-77]. Exploitation requires only that the attacker influence a string passed as an envelope address to one of the affected methods, which is a common pattern in web applications that accept user-supplied email addresses.

Root Cause

The affected methods concatenate user-controlled address strings into SMTP command lines without validating or rejecting C0 control characters (0x00-0x1F) or DEL (0x7F). CR (\r), LF (\n), and NUL (\\x00) in particular allow command boundary injection. SMTP.send_message() avoids the flaw because it constructs addresses from a validated Message object.

Attack Vector

An attacker supplies an address containing an embedded CRLF sequence followed by an SMTP verb. Consider an application that calls smtp.sendmail(from_addr=user_input, ...). If user_input contains attacker@example.com\r\nRCPT TO:<victim@example.com>, the server processes the injected RCPT TO as if issued by the client.

text

Security: Reject control characters (the C0 range 0x00-0x1F and DEL
0x7F, including CR, LF, and NUL) in SMTP command arguments, preventing
command injection via input passed to mail(), rcpt(), vrfy(),
expn() or sendmail(). Such input now raises ValueError before
anything is written to the connection.

Source: aiosmtplib CHANGELOG patch

Detection Methods for CVE-2026-53533

Indicators of Compromise

Unexpected RCPT TO, MAIL FROM, RSET, DATA, or AUTH commands in SMTP server logs originating from application clients using aiosmtplib.
Outbound mail with recipients or senders that were not authorized by the calling application.
SMTP client processes hanging or timing out on sendmail() or send() calls.

Detection Strategies

Inspect application dependency manifests (requirements.txt, poetry.lock, Pipfile.lock) for aiosmtplib versions below 5.1.1.
Audit application code for calls to SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), SMTP.expn(), SMTP.sendmail(), and SMTP.send() that accept user-controlled addresses.
Correlate SMTP server transaction logs against application mail send logs to identify commands that lack a corresponding application-level request.

Monitoring Recommendations

Enable verbose SMTP command logging on outbound mail relays to capture unexpected command sequences per session.
Alert on SMTP sessions from application hosts that issue additional RCPT TO commands beyond declared recipient counts.
Monitor for input containing CR (0x0D) or LF (0x0A) bytes in fields destined for mail delivery APIs at the web application firewall (WAF) or input validation layer.

How to Mitigate CVE-2026-53533

Immediate Actions Required

Upgrade aiosmtplib to version 5.1.1 or later in all Python environments and container images.
Rebuild and redeploy applications and serverless functions that bundle vulnerable versions.
Add server-side validation to reject email addresses containing control characters before passing them to any SMTP client library.

Patch Information

The fix is available in aiosmtplib 5.1.1. The patch introduces a COMMAND_INJECTION_REGEX that rejects the C0 control range and DEL, raising ValueError before any bytes are written to the connection. Full details are documented in the GitHub Security Advisory GHSA-v3q9-hj7j-63hq and the aiosmtplib v5.1.1 release notes.

python

MAX_LINE_LENGTH = 8192
LINE_ENDINGS_REGEX = re.compile(rb"(?:\r\n|\n|\r(?!\n))")
PERIOD_REGEX = re.compile(rb"(?m)^\.")
# Reject all C0 controls + DEL; CR/LF/NUL in particular enable injection.
COMMAND_INJECTION_REGEX = re.compile(rb"[\\x00-\\x1f\\x7f]")

Source: aiosmtplib protocol.py patch

Workarounds

Refactor call sites to use SMTP.send_message() with a validated email.message.Message object, which is not affected by this vulnerability.
Validate all user-supplied email addresses against RFC 5321 syntax and explicitly reject any string containing bytes in the range 0x00-0x1F or 0x7F before passing them to SMTP methods.
Restrict outbound SMTP traffic from application servers to a controlled relay that enforces recipient allow-lists.

bash

# Upgrade aiosmtplib to the patched version
pip install --upgrade 'aiosmtplib>=5.1.1'

# Verify the installed version
python -c "import aiosmtplib; print(aiosmtplib.__version__)"