CVE-2026-90467: aiosmtplib ESMTP Parameter Injection XSS

CVE-2026-90467 Overview

CVE-2026-90467 affects aiosmtplib, an asynchronous SMTP client library for Python, in versions before 5.1.3. The library fails to properly validate email addresses supplied by callers, permitting attackers to inject Extended SMTP (ESMTP) parameters into MAIL FROM and RCPT TO command lines. Crafted addresses containing spaces and angle brackets can append parameters such as AUTH, NOTIFY, or ORCPT to envelope commands. This enables attackers to forge authenticated identities or redirect delivery status notifications to third parties. The flaw is a follow-up to CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which addressed only control characters in addresses.

Critical Impact
Attackers who control any email address value passed to aiosmtplib can smuggle ESMTP parameters into envelope commands, forging authenticated sender identities and redirecting delivery notifications.

Affected Products

aiosmtplib versions prior to 5.1.3
Python applications using aiosmtplib for asynchronous SMTP delivery
Downstream frameworks and services embedding vulnerable aiosmtplib versions

Discovery Timeline

2026-09-12 - CVE-2026-90467 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90467

Vulnerability Analysis

The vulnerability is an argument injection flaw classified under [CWE-88]. aiosmtplib relies on Python's email.utils.parseaddr to normalize addresses before writing them onto the SMTP command line. That function is lenient and passes through whitespace and angle brackets found outside of a quoted local part. When an attacker-controlled address such as user@example.com> AUTH=<attacker@example.com is placed into a MAIL FROM: or RCPT TO: command, the trailing whitespace and angle brackets terminate the mailbox and introduce additional ESMTP parameters. The SMTP server parses the resulting line as a legitimate command with attacker-chosen parameters, enabling identity forgery via AUTH=, third-party notification delivery via NOTIFY= or ORCPT=, and similar envelope manipulation.

Root Cause

The library did not validate that supplied addresses were safe to place on an SMTP command line. The 5.1.1 patch for CVE-2026-53533 only rejected control characters, leaving whitespace and angle brackets outside quoted local parts as viable injection vectors. Addresses reaching the mail, rcpt, vrfy, expn, and sendmail methods were serialized directly into wire commands without additional syntactic checks.

Attack Vector

Exploitation requires an application that accepts external input and passes it as an address parameter to aiosmtplib. This is a common pattern in web applications that use user-supplied email addresses for account signup, password resets, or contact forms. No authentication to the SMTP server is required from the attacker's side, and no user interaction is needed at the victim server. The attack occurs at the SMTP protocol level between the vulnerable client and a downstream mail server.

python

# Security patch in src/aiosmtplib/email.py
# Source: https://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2

SPECIALS_REGEX = re.compile(r'[][\\()<>@,:;".]')
ESCAPES_REGEX = re.compile(r'[\\"]')
UTF8_CHARSET = email.charset.Charset("utf-8")
# Characters that would end the address on an SMTP command line (or start a
# new command), and so can't appear in a mailbox outside of a quoted-string
# local part. Whitespace here includes CR/LF, so this also serves as a first
# line of defence against command injection.
ADDRESS_INJECTION_REGEX = re.compile(r'[\s<>"]')
QUOTED_LOCAL_PART_REGEX = re.compile(r'^"(?:[^"\\\r\n]|\\.)*"')


def _validate_address(address: str) -> None:
    """
    Reject addresses that can't be safely placed on an SMTP command line.

    ``email.utils.parseaddr`` is lenient, and will pass through strings that
    contain whitespace or angle brackets; if we sent those as-is, a caller
    supplied address could smuggle extra ESMTP parameters (or commands) into
    the MAIL, RCPT, VRFY and EXPN commands.
    """
    # A quoted-string local part may legitimately contain these characters
    unquoted_address = QUOTED_LOCAL_PART_REGEX.sub("", address, count=1)
    if ADDRESS_INJECTION_REGEX.search(unquoted_address):
        raise ValueError(
            f"Address {address!r} contains characters not permitted in an SMTP mailbox"
        )

The patch adds _validate_address, which strips an optional quoted local part and rejects any residual whitespace, angle brackets, or double quotes. See the GitHub commit details for aiosmtplib for the complete change set.

Detection Methods for CVE-2026-90467

Indicators of Compromise

SMTP server logs showing MAIL FROM: or RCPT TO: commands containing unexpected AUTH=, NOTIFY=, or ORCPT= parameters not emitted by the application's normal flow.
Delivery Status Notification (DSN) messages sent to third-party addresses that were never provided as recipients.
Outbound envelope commands with addresses containing embedded whitespace or unmatched angle brackets.

Detection Strategies

Perform a software composition analysis (SCA) scan across Python projects to identify aiosmtplib versions below 5.1.3.
Instrument application code paths that call aiosmtplib.send, SMTP.sendmail, SMTP.mail, or SMTP.rcpt and log the raw address arguments for review.
Enable verbose SMTP transaction logging on outbound relays and alert on envelope commands containing more parameters than the application would produce.

Monitoring Recommendations

Monitor mail relay logs for anomalous AUTH=, NOTIFY=, or ORCPT= values on envelope commands originating from application submission hosts.
Track the rate of DSN messages destined for external domains and alert on statistical deviations.
Correlate application error logs for ValueError exceptions raised by _validate_address after patching, which indicate blocked injection attempts.

How to Mitigate CVE-2026-90467

Immediate Actions Required

Upgrade aiosmtplib to version 5.1.3 or later across all Python environments and container images.
Audit application code that passes user-controlled strings to aiosmtplib address parameters and add server-side email validation.
Rotate any SMTP credentials that may have been used with vulnerable clients where log evidence suggests envelope manipulation.

Patch Information

The fix is included in aiosmtplib release v5.1.3. The patch introduces _validate_address, which rejects addresses containing whitespace, angle brackets, or double quotes outside of a quoted local part. It is applied to the mail, rcpt, vrfy, expn, and sendmail methods, and sendmail now validates all addresses before sending any commands. Additional context is available in the VulnCheck advisory for aiosmtplib.

Workarounds

Apply strict address validation in the application layer before calling aiosmtplib, rejecting any input containing whitespace, <, >, or " outside of a quoted local part.
Restrict which ESMTP extensions the receiving mail server honors from application submission hosts, disabling AUTH=, NOTIFY=, and ORCPT= where not required.
Route outbound mail through a hardened relay that re-parses envelope addresses and drops unexpected parameters.

bash

# Configuration example: pin a safe aiosmtplib version
pip install 'aiosmtplib>=5.1.3'

# Verify the installed version
python -c "import aiosmtplib; print(aiosmtplib.__version__)"