CVE-2026-93012: Email::Sender::Transport::Sendmail RCE

CVE-2026-93012 Overview

CVE-2026-93012 is a command injection vulnerability in the Perl module Email::Sender::Transport::Sendmail in versions before 2.602. On Windows (MSWin32), the transport assembles the envelope sender and recipients into a single command string that open() passes to a shell. When callers rely on Email::Sender::Simple without supplying an explicit envelope, the module derives addresses from the To, Cc, and From headers. An attacker who controls any of those header values can inject shell metacharacters and execute arbitrary commands as the sending process. The flaw is classified as OS Command Injection [CWE-78].

Critical Impact
Remote attackers can achieve arbitrary command execution on Windows hosts running vulnerable versions of Email::Sender simply by controlling an email header address processed by the Sendmail transport.

Affected Products

Email::Sender Perl distribution versions prior to 2.602
Email::Sender::Transport::Sendmail on Windows (MSWin32) platforms
Applications using Email::Sender::Simple that pass user-controlled To, Cc, or From headers on Windows

Discovery Timeline

2026-09-21 - CVE-2026-93012 published to the National Vulnerability Database (NVD)
2026-09-21 - Vulnerability discussed on the OpenWall oss-security mailing list
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-93012

Vulnerability Analysis

The defect resides in the _sendmail_pipe routine of Email::Sender::Transport::Sendmail. On non-Windows platforms, the module invokes sendmail using the list form of Perl's open(), which bypasses the shell and passes each argument directly to the executable. On MSWin32, no equivalent list-form invocation is available across all supported Perl versions, so the transport concatenates the program path, envelope sender, and each recipient into a single command string that Windows executes through a shell.

When a caller uses Email::Sender::Simple without supplying an explicit envelope argument, the module derives the envelope sender from the From header and the recipients from the To and Cc headers. Any shell metacharacter present in those addresses is interpreted by the command line parser rather than treated as part of an email address.

Root Cause

The root cause is unsafe construction of a shell command line from untrusted input. The transport did not validate envelope addresses before interpolating them into the command string on Windows, and it treated header-derived addresses as trusted. This pattern matches [CWE-78] OS Command Injection.

Attack Vector

An attacker who can influence the From, To, or Cc header of a message sent by a vulnerable Windows application supplies an address containing shell metacharacters. When the application calls Email::Sender::Simple->send, the Sendmail transport passes the malicious string to the shell, executing attacker-supplied commands with the privileges of the sending Perl process. No authentication or user interaction on the target host is required.

text

# Patch excerpt: lib/Email/Sender/Transport/Sendmail.pm and Changes
# Source: https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c.patch

+        - SECURITY: the Sendmail transport built a shell command line on Win32,
+          so an envelope address containing shell metacharacters -- which can
+          come from the To, Cc, or From header of a message sent with
+          Email::Sender::Simple -- could execute arbitrary commands.  On Win32,
+          envelope addresses are now checked against a conservative pattern, and
+          anything else is now rejected with a permanent failure.

+=head2 Win32 and envelope addresses
+
+Because that command line will be taken apart again by a command line parser,
+this transport will refuse to send mail on Win32 unless every envelope address
+is made up only of letters, digits, and the characters C<-._+=@>, beginning
+with a letter or digit on each side of the C<@>.  Anything else -- including
+plenty of addresses that are perfectly legal under RFC 5322 -- gets a
+L<Email::Sender::Failure::Permanent> instead of a delivery.

+use Email::Sender::Failure::Permanent;
+sub _is_win32 { $^O eq 'MSWin32' }

The patch introduces a conservative allow-list for envelope addresses on Windows and returns an Email::Sender::Failure::Permanent for any address outside that pattern.

Detection Methods for CVE-2026-93012

Indicators of Compromise

Perl processes (perl.exe) on Windows spawning cmd.exe, powershell.exe, or other shells as child processes during mail delivery.
Windows event logs showing unexpected child processes launched by web applications, job schedulers, or CGI handlers that use Email::Sender.
Outbound network connections initiated by processes spawned from a Perl mail-sending workflow.
Mail queue or application logs containing envelope or header addresses with shell metacharacters such as `, |, &, ;, $(, or ".

Detection Strategies

Inventory Windows hosts running Perl and enumerate installed versions of the Email-Sender distribution; flag any version below 2.602.
Correlate process ancestry to identify shells or LOLBins launched from Perl interpreters that handle inbound email content.
Inspect application and mail logs for header values containing characters outside the RFC-safe subset used by the patched allow-list (A-Za-z0-9-._+=@).

Monitoring Recommendations

Enable command-line auditing (Audit Process Creation with command line inclusion) on Windows systems that send mail via Perl.
Alert on any child process of perl.exe that is a shell interpreter or scripting host.
Track outbound connections and file writes originating from mail-sending workers to detect post-exploitation activity.

How to Mitigate CVE-2026-93012

Immediate Actions Required

Upgrade the Email-Sender Perl distribution to version 2.602 or later on every Windows host.
Audit applications that call Email::Sender::Simple and validate or sanitize the To, Cc, and From headers before use.
Where possible, pass an explicit envelope argument with pre-validated addresses rather than relying on header-derived envelopes.

Patch Information

The fix is included in Email-Sender 2.602, published on MetaCPAN. See the GitHub patch commit and the MetaCPAN Email-Sender 2.602 Changes. Additional discussion is available on the OpenWall oss-security thread. The patched transport enforces a strict address pattern on MSWin32 and returns Email::Sender::Failure::Permanent for anything outside that pattern.

Workarounds

Switch Windows workloads to Email::Sender::Transport::SMTP, which does not invoke a shell.
Reject or strip inbound header addresses that contain characters outside [A-Za-z0-9._+=@-] before invoking the transport.
Run Perl mail-sending processes under least-privilege service accounts to limit the impact of successful injection.

bash

# Upgrade Email-Sender to the patched release using cpanm
cpanm RJBS/Email-Sender-2.602.tar.gz

# Verify the installed version
perl -MEmail::Sender -e 'print $Email::Sender::VERSION, "\n"'