{"id":"CVE-2026-53533","aliases":["GHSA-v3q9-hj7j-63hq","PYSEC-2026-2338"],"url":"https://o3.security/vulnerability/CVE-2026-53533","summary":"aiosmtplib: SMTP command injection via CR/LF in sender/recipient address","details":"### Summary\n\n`aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email address to the server without rejecting embedded CR/LF (`\\r\\n`) bytes. An address that contains a CR/LF is written verbatim onto the SMTP control connection, so the bytes after the CRLF are framed by the server as one or more **additional, standalone SMTP command lines**. A caller that passes an attacker-influenced sender or recipient address into `mail()`/`rcpt()` (or `vrfy()`/`expn()`) therefore allows **SMTP command injection** (CWE-93 / CWE-77): the attacker can smuggle arbitrary SMTP verbs such as `MAIL FROM`, `RCPT TO`, `RSET`, `DATA`, or `AUTH` into the session. Injected commands will cause the `SMTP` instance to hang, but all commands required to complete the envelope could be sent in one address string.\n\nThe `SMTP.sendmail()` command will pass sender and recipient addresses verbatim through to `SMTP.mail()` & `SMTP.rcpt()`, and so is also vulnerable. `SMTP.send_message()` is not affected.\n\n### Impact\n\nSeverity: medium. Type: SMTP protocol command injection (CWE-93 — Improper Neutralization of CRLF Sequences; CWE-77 — Command Injection).\n\nWhen an application built on `aiosmtplib` derives the envelope sender or any recipient from data an attacker can influence (a web form etc.) and passes it to `mail()`/`rcpt()` (directly, or via `sendmail()`/`send()` without a `Message` object), the attacker can:\n\n- desynchronize the command/response pipeline and cause the aiosmtplib client to hang, resulting in a possible denial of service\n- inject multiple commands in one address to send an arbitrary message\n\nThe address only needs to reach `mail()`/`rcpt()`/`vrfy()`/`expn()`; no attacker control over the SMTP server is required.\n\n### Vulnerable versions\n\nAffected version: `aiosmtplib` 5.1.0 (latest at time of report) and all earlier releases.\n\n### Credit\n\nReported by tonghuaroot.","published":"2026-08-18T17:54:23.124Z","modified":"2026-10-24T02:30:41.273178251Z","cvss":null,"epss":{"score":0.00385,"percentile":0.32243,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"aiosmtplib","fixedVersion":"5.1.1"}],"fix":{"url":"https://github.com/cole/aiosmtplib/commit/8eaf6efc9a8f59e2e09d3ef11246a058c46bd3ba","label":"cole/aiosmtplib@8eaf6ef"},"references":[{"type":"WEB","url":"https://github.com/cole/aiosmtplib/releases/tag/v5.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53533.json"},{"type":"ADVISORY","url":"https://github.com/cole/aiosmtplib/security/advisories/GHSA-v3q9-hj7j-63hq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53533"},{"type":"FIX","url":"https://github.com/cole/aiosmtplib/commit/8eaf6efc9a8f59e2e09d3ef11246a058c46bd3ba"},{"type":"PACKAGE","url":"https://github.com/cole/aiosmtplib"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:30:41.273178251Z"}}