CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into M
CVSS
4.0
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Sep 12, 2026 · Last modified: Sep 12, 2026 · CWE-88
Not enough EPSS history yet.
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.
- github.comhttps://github.com/cole/aiosmtplib
- github.comhttps://github.com/cole/aiosmtplib/blob/v5.1.2/src/aiosmtplib/email.py
- github.comhttps://github.com/cole/aiosmtplib/commit/2e1b210714974ccc9efd0d09a8f846cb9aeaaec2
- github.comhttps://github.com/cole/aiosmtplib/releases/tag/v5.1.3
- www.vulncheck.comhttps://www.vulncheck.com/advisories/aiosmtplib-before-5.1.3-esmtp-parameter-injection-via-unvalidated-addresses
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-890667.8 HIG—
——0Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions.
To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.1dCVE-2026-117653.3 LOW—
——0Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection.
This issue affects Pardus Pen: before 4.2.1.1dCVE-2026-0304—12.2%
——4A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.2dCVE-2026-8044—36.2%
——11CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.3dCVE-2026-878186.5 MED13.5%
——4GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.3dCVE-2026-877948.4 HIG8.5%
——3bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.2d