Vulnerabilities

TI-2026-61498 CVE-2026-90467 · GHSA-qh75-x5jv-g7wg

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

LOW 28

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00393 Published 2026-09-12 Fixed in 5.1.3 CWE-88

TI-2026-40102 CVE-2026-55558 · GHSA-vxj7-4xrp-5vr4

aiosmtplib: STARTTLS response injection

LOW 27

aiosmtplib is an asynchronous SMTP client for use with asyncio.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00403 Published 2026-08-20 Fixed in 5.1.2 CWE-74

TI-2026-38606 CVE-2026-53533 · GHSA-v3q9-hj7j-63hq

aiosmtplib: SMTP command injection via CR/LF in sender/recipient address

LOW 31

aiosmtplib is an asynchronous SMTP client for use with asyncio.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00525 Published 2026-08-18 Fixed in 5.1.1 CWE-77

Vulnerabilities

Filters

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

aiosmtplib: STARTTLS response injection

aiosmtplib: SMTP command injection via CR/LF in sender/recipient address